serve vulnerabilities

3 known vulnerabilities in serve from PyTorch. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  serve: Exposure of Resource to Wrong Sphere

  CVE-2024-35199Jul 19, 2024PyTorch

  TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and 7071, are not bound to [localhost](http://localhost/) by default, so when TorchServe is launched, these two int

• 9.8 Critical severity

  serve: Use of Incorrectly-Resolved Name or Reference

  CVE-2024-35198Jul 19, 2024PyTorch

  TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowed_urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being down

• 9.8 Critical severity

  serve: Server-Side Request Forgery

  CVE-2023-43654Sep 28, 2023PyTorchEPSS 42.5%

  TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken adv