PyTorch Lightning denial of service vulnerability

CVE-2024-8020 · Published Mar 20, 2025 · updated Sep 10, 2026

High7.5

No fix yet

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server shutting down.

Affected versions

Package	Affected	Fixed in
pytorch-lightning PyPI	<= 2.3.2	No fix yet

Details and references

CVSS 3.0: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-248
Also known as: CVE-2024-8020, PYSEC-2026-1857, PYSEC-2026-3971

More pytorch-lightning advisories

All pytorch-lightning

Critical 9.1Sep 10

pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpointCVE-2024-5980fixed in 2.3.3 Critical 9.8Sep 10

Remote code execution in pytorch lightningCVE-2024-5452fixed in 2.3.3 High 7.8Jul 15

pytorch-lightning: remote code executionCVE-2026-58659fixed in 2.6.6 High 7.8May 12

PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserializationCVE-2026-31221no fix yet Critical 9.8May 7

Compromise of PyTorch Lightning PyPi Package VersionsCVE-2026-44484no fix yet Critical 9.1Mar 20, 2025

PyTorch Lightning path traversal vulnerabilityCVE-2024-8019fixed in 2.4.0