← Vulnerability feed

Vulnerability record · CVE-2024-35198 · published 19 July 2024

CVE-2024-35198: Pytorch torchserve vulnerability

Pytorch · Torchserve

TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowed_urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which effectively bypasses the allowed_urls security check. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed by validating the URL without characters such as ".." before downloading see PR #3082. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.

9.8 CVSS 3.1 Critical EPSS 0.80% · top 45.2% CWE-706 · CWE-706
9.8CVSS 3.1 base score
0.80%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowed_urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which effectively bypasses the allowed_urls security check. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed by validating the URL without characters such as ".." before downloading see PR #3082. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pytorch/serve/pull/3082 Patch
https://github.com/pytorch/serve/releases/tag/v0.11.0 Release Notes
https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2 Third Party Advisory
https://github.com/pytorch/serve/pull/3082 Patch
https://github.com/pytorch/serve/releases/tag/v0.11.0 Release Notes
https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2 Third Party Advisory

Track CVE-2024-35198 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-43654Pytorch torchserve server-side request forgery (ssrf) vulnerabilityTorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling t…EPSS 36%8.2CVE-2024-35199Pytorch torchserve exposure of resource to wrong sphere vulnerabilityTorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and …EPSS 0.64%5.3CVE-2023-48299Pytorch torchserve path traversal vulnerabilityTorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/work…EPSS 0.68%9.8CVE-2025-24813Apache Tomcat Default Servlet path equivalence enables RCE and file disclosureApache Tomcat mishandles path equivalence for names containing an internal dot, letting a remote unauthenticated attacker write files through the Def…KEVEPSS 100%analysed9.8CVE-2021-40539Zoho ManageEngine ADSelfService Plus REST API auth bypass to RCEZoho ManageEngine ADSelfService Plus version 6113 and prior contains an authentication bypass in its REST API that leads to remote code execution. Be…KEVEPSS 99%analysed9.8CVE-2020-15505MobileIron Core, Connector, Sentry and RDB remote code executionMobileIron Core, Enterprise Connector, Sentry and Monitor and Reporting Database contain a remote code execution flaw reachable over the network with…KEVEPSS 100%analysed

Source: NIST National Vulnerability Database (record CVE-2024-35198), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.