GHSA-887c-mr87-cxwp
First published: Wed Apr 16 2025(Updated: )
A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is 46fc5d8e360127361211cb237d5f9eef0223e567. It is recommended to apply a patch to fix this issue.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/torch | <=2.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2025-3730
- https://github.com/pytorch/pytorch/issues/150835
- https://github.com/pytorch/pytorch/pull/150981
- https://vuldb.com/?ctiid.305076
- https://vuldb.com/?id.305076
- https://vuldb.com/?submit.553645
- https://github.com/pytorch/pytorch/commit/01f226bfb8f2c343f5c614a6bbf685d91160f3af
- https://github.com/advisories/GHSA-887c-mr87-cxwp (Advisory)
Frequently Asked Questions
What is the severity of GHSA-887c-mr87-cxwp?
GHSA-887c-mr87-cxwp is classified as a problematic vulnerability leading to denial of service.
How do I fix GHSA-887c-mr87-cxwp?
To mitigate GHSA-887c-mr87-cxwp, update the PyTorch package to a version newer than 2.6.0.
Which versions of PyTorch are affected by GHSA-887c-mr87-cxwp?
PyTorch versions up to and including 2.6.0 are affected by GHSA-887c-mr87-cxwp.
What function in PyTorch is vulnerable according to GHSA-887c-mr87-cxwp?
The vulnerability in GHSA-887c-mr87-cxwp affects the torch.nn.functional.ctc_loss function.
Is the GHSA-887c-mr87-cxwp vulnerability exploitable remotely?
No, the exploitation of GHSA-887c-mr87-cxwp must be approached locally.
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-887c-mr87-cxwp
- alias/CVE-2025-3730
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/source
- agent/softwarecombine
- agent/tags
- agent/description
- agent/type
- agent/first-publish-date
- agent/event
- package-manager/pip