pytorch-lightningGHSA-98fp-7v67-4v3q
PyTorch Lightning denial of service vulnerability
High7.5CVE-2024-8020 · Published Mar 20, 2025 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| pytorch-lightning PyPI | <= 2.3.2 | No fix yet |
Details and references
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs due to improper handling of unexpected state values, which results in the server shutting down.
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-248
- Also known as
- CVE-2024-8020, PYSEC-2026-1857, PYSEC-2026-3971
More pytorch-lightning advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 202025 | PyTorch Lightning path traversal vulnerability CVE-2024-8019Critical9.1fixed in 2.4.0 | Critical9.1 | 2.4.0 |
| May 7 | Compromise of PyTorch Lightning PyPi Package Versions CVE-2026-44484Critical9.8no fix yet | Critical9.8 | No fix yet |
| May 12 | PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization CVE-2026-31221High7.8no fix yet | High7.8 | No fix yet |
| Jul 15 | PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass we CVE-2026-58659High7.8fixed in 2.6.6 | High7.8 | 2.6.6 |
| Sep 10 | Remote code execution in pytorch lightning CVE-2024-5452Critical9.8fixed in 2.3.3 | Critical9.8 | 2.3.3 |
| Sep 10 | pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint CVE-2024-5980Critical9.1fixed in 2.3.3 | Critical9.1 | 2.3.3 |