Skip to content
This repository was archived by the owner on Jul 7, 2026. It is now read-only.

Update dependency torch to v2 [SECURITY] - #252

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/pypi-torch-vulnerability
Open

Update dependency torch to v2 [SECURITY]#252
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/pypi-torch-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jan 18, 2023 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
torch ==1.6.0 → ==2.10.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

PyTorch vulnerable to arbitrary code execution

CVE-2022-45907 / GHSA-47fc-vmwq-366v

More information

Details

In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely. The fix for this issue is available in version 1.13.1. There is a release checker in issue #​89855.

Severity

  • CVSS Score: 9.3 / 10 (Critical)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

PyTorch heap buffer overflow vulnerability

CVE-2024-31580 / GHSA-5pcm-hx3q-hm94

More information

Details

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Pytorch use-after-free vulnerability

CVE-2024-31583 / GHSA-pg7h-5qx3-wjr3

More information

Details

Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp.

Severity

  • CVSS Score: 7.8 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

PyTorch susceptible to local Denial of Service

CVE-2025-2953 / GHSA-3749-ghw9-m3mg

More information

Details

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Severity

  • CVSS Score: 1.9 / 10 (Low)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

PyTorch Improper Resource Shutdown or Release vulnerability

CVE-2025-3730 / GHSA-887c-mr87-cxwp

More information

Details

A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is 46fc5d8e360127361211cb237d5f9eef0223e567. It is recommended to apply a patch to fix this issue.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

PyTorch: torch.load with weights_only=True leads to remote code execution

CVE-2025-32434 / GHSA-53q9-r3pm-6pq6

More information

Details

Description

I found a Remote Command Execution (RCE) vulnerability in PyTorch. When loading model using torch.load with weights_only=True, it can still achieve RCE.

Background knowledge

https://github.com/pytorch/pytorch/security
As you can see, the PyTorch official documentation considers using torch.load() with weights_only=True to be safe.
image
Since everyone knows that weights_only=False is unsafe, so they will use the weights_only=True to mitigate the seucirty issue.
But now, I just proved that even if you use weights_only=True, it can still achieve RCE.

Credit

This vulnerability was found by Ji'an Zhou.

Severity

  • CVSS Score: 9.3 / 10 (Critical)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

PyTorch is vulnerable to memory corruption through its unpack_sequence function

CVE-2025-2999 / GHSA-vgrw-7cvw-pwgx

More information

Details

A vulnerability was found in PyTorch 2.6.0. It has been rated as critical. Affected by this issue is the function torch.nn.utils.rnn.unpack_sequence. The manipulation leads to memory corruption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.

A patch is available through commit 4945180.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

PyTorch is vulnerable to memory corruption through its torch.lstm_cell function

CVE-2025-3001 / GHSA-qfhq-4f3w-5fph

More information

Details

A vulnerability classified as critical was found in PyTorch 2.6.0. This vulnerability affects the function torch.lstm_cell. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

A patch is available through commit 999d94b.

Severity

  • CVSS Score: 1.9 / 10 (Low)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

pytorch/pytorch (torch)

v2.10.0: PyTorch 2.10.0 Release

Compare Source

PyTorch 2.10.0 Release Notes

Highlights

Python 3.14 support for torch.compile(). Python 3.14t (freethreaded build) is experimentally supported as well.
Reduced kernel launch overhead with combo-kernels horizontal fusion in torchinductor
A new varlen_attn() op providing support for ragged and packed sequences
Efficient eigenvalue decompositions with DnXgeev
torch.compile() now respects use_deterministic_mode
DebugMode for tracking dispatched calls and debugging numerical divergence - This makes it simpler to track down subtle numerical bugs.
Intel GPUs support: Expand PyTorch support to the latest Panther Lake on Windows and Linux by enabling FP8 (core ops and scaled matmul) and complex MatMul support, and extending SYCL support in the C++ Extension API for Windows custom ops.

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Backwards Incompatible Changes

Dataloader Frontend

  • Removed unused data_source argument from Sampler (#​163134). This is a no-op, unless you have a custom sampler that uses this argument. Please update your custom sampler accordingly.
  • Removed deprecated imports for torch.utils.data.datapipes.iter.grouping (#​163438). from torch.utils.data.datapipes.iter.grouping import SHARDING_PRIORITIES, ShardingFilterIterDataPipe is no longer supported. Please import from torch.utils.data.datapipes.iter.sharding instead.

torch.nn

  • Remove Nested Jagged Tensor support from nn.attention.flex_attention (#​161734)

ONNX

  • fallback=False is now the default in torch.onnx.export (#​162726)
  • The exporter now uses the dynamo=True option without fallback. This is the recommended way to use the ONNX exporter. To preserve 2.9 behavior, manually set fallback=True in the torch.onnx.export call.

Release Engineering

  • Rename pytorch-triton package to triton (#​169888)

Deprecations

Distributed

  • DeviceMesh
    • Added a warning for slicing flattened dim from root mesh and types for _get_slice_mesh_layout (#​164993)

We decided to deprecate an existing behavior which goes against the PyTorch design principle (explicit over implicit) for device mesh slicing of flattened dim.

Version <2.9
import torch
from torch.distributed.device_mesh import

device_type = (
    acc.type
    if (acc := torch.accelerator.current_accelerator(check_available=True))
    else "cpu"
)
mesh_shape = (2, 2, 2)
mesh_3d = init_device_mesh(
    device_type, mesh_shape, mesh_dim_names=("dp", "cp", "tp")
)

mesh_3d["dp", "cp"]._flatten()
mesh_3["dp_cp"]  # This comes with no warning
Version >=2.10
import torch
from torch.distributed.device_mesh import

device_type = (
    acc.type
    if (acc := torch.accelerator.current_accelerator(check_available=True))
    else "cpu"
)
mesh_shape = (2, 2, 2)
mesh_3d = init_device_mesh(
    device_type, mesh_shape, mesh_dim_names=("dp", "cp", "tp")
)

mesh_3d["dp", "cp"]._flatten()
mesh_3["dp_cp"]  # This will come with a warning because it implicitly change the state of the original mesh. We will eventually remove this behavior in future release. User should do the bookkeeping of flattened mesh explicitly.

Ahead-Of-Time Inductor (AOTI)

  • Move from/to to torch::stable::detail (#​164956)

JIT

  • torch.jit is not guaranteed to work in Python 3.14. Deprecation warnings have been added to user-facing torch.jit API (#​167669).

torch.jit should be replaced with torch.compile or torch.export.

ONNX

  • The dynamic_axes option in torch.onnx.export is deprecated (#​165769)

Users should supply the dynamic_shapes argument instead. See https://docs.pytorch.org/docs/stable/export.html#expressing-dynamism for more documentation.

Profiler

  • Deprecate export_memory_timeline method (#​168036)

The export_memory_timeline method in torch.profiler is being deprecated in favor of the newer memory snapshot API (torch.cuda.memory._record_memory_history and torch.cuda.memory._export_memory_snapshot). This change adds the deprecated decorator from typing_extensions and updates the docstring to guide users to the recommended alternative.

New Features

Autograd

  • Allow setting grad_dtype on leaf tensors (#​164751)
  • Add Default Autograd Fallback for PrivateUse1 in PyTorch (#​165315)
  • Add API to annotate disjoint backward for use with torch.utils.checkpoint.checkpoint (#​166536)

Complex Frontend

Composability

cuDNN

  • BFloat16 support added to cuDNN RNN (#​164411)
  • [cuDNN][submodule] Upgrade to cuDNN frontend 1.16.1 (#​170591)

Distributed

  • LocalTensor:

    • LocalTensor is a powerful debugging and simulation tool in PyTorch's distributed tensor ecosystem. It allows you to simulate distributed tensor computations across multiple SPMD (Single Program, Multiple Data) ranks on a single process. This is incredibly valuable for: 1) debugging distributed code without spinning up multiple processes; 2) understanding DTensor behavior by inspecting per-rank tensor states; 3) testing DTensor operations with uneven sharding across ranks; 4) rapid prototyping of distributed algorithms. Note that LocalTensor is designed for debugging purposes only. It has significant overhead and is not suitable for production distributed training.
    • LocalTensor is a torch.Tensor subclass that internally holds a mapping from rank IDs to local tensor shards. When you perform a PyTorch operation on a LocalTensor, the operation is applied independently to each local shard, mimicking distributed computation (LocalTensor simulates collective operations locally without actual network communication.). LocalTensorMode is the context manager that enables LocalTensor dispatch. It intercepts PyTorch operations and routes them appropriately. The @maybe_run_for_local_tensor decorator is essential for handling rank-specific logic when implementing distributed code.
    • To get started with LocalTensor, users import from torch.distributed._local_tensor, initialize a fake process group, and wrap their distributed code in a LocalTensorMode context. Within this context, DTensor operations automatically produce LocalTensors.
    • PRs: (#​164537, #​166595, #​168110,#​168314,#​169088,#​169734)

  • c10d:

    • New shrink_group implementation to expose ncclCommShrink API (#​164518)

Dynamo

  • torch.compile now fully works in Python 3.14 (#​167384)
  • Add option to error or disable applying side effects (#​167239)
  • Config flag (skip_fwd_side_effects_in_bwd_under_checkpoint) to allow eager and compile activation-checkpointing divergence for side-effects (#​165775)
  • torch._higher_order_ops.print for enabling printing without graph breaks or reordering (#​167571)

FX

  • Added node metadata annotation API

  • Disable preservation of node metadata when enable=False (#​164772)

  • Annotation should be mapped across submod (#​165202)

  • Annotate bw nodes before eliminate dead code (#​165782)

  • Add logging for debugging annotation (#​165797)

  • Override metadata on regenerated node in functional mode (#​166200)

  • Skip copying custom meta for gradient accumulation nodes; tag with is_gradient_acc=True (#​167572)

  • Add metadata hook for all nodes created in runtime_assert pass (#​169497)

  • Update gm.print_readable to include Annotation (#​165397)

  • Add annotation to assertion nodes in export (#​167171)

  • Add debug mode to print meta in fx graphs (#​165874)

Inductor

Ahead-Of-Time Inductor (AOTI)

  • Integrate AOTI as a backend. (#​167338)
  • Add AOTI mingw cross compilation for Windows. (#​163188)

MPS

torch.nn

ONNX

  • A new testing module torch.onnx.testing with a testing utility assert_onnx_program (#​162495)

Profiler

Quantization

  • Add _scaled_mm_v2 API (#​164141)

  • Add scaled_grouped_mm_v2 and python API (#​165154)

  • Add embedding_bag_byte_prepack_with_rowwise_min_max and embedding_bag_{2/4}bit_prepack_with_rowwise_min_max (#​162924)

  • Add MXFP4 support for _scaled_grouped_mm_v2 via. FBGEMM kernels (#​166530)

Release Engineering

ROCm

  • Enable grouped GEMM via regular GEMM fallback (#​162419)
  • Enable grouped GEMM via CK (#​166334, #​167403)
  • Enable ATen GEMM overload for FP32 output from FP16/BF16 inputs (#​162600)
  • Support torch.cuda._compile_kernel (#​162510)
  • Enhanced Windows support
  • load_inline (#​162577)
  • Enable AOTriton runtime compile (#​165538)
  • AOTriton scaled_dot_product_attention (#​162330)
  • Add gfx1150 gfx1151 to hipblaslt-supported GEMM lists (#​164744)
  • Add scaled_mm v2 support. (#​165528)
  • Add torch.version.rocm, distinct from torch.version.hip (#​168097)

XPU

  • Support ATen operators scaled_mm and scaled_mm_v2 for Intel GPU (#​166056)
  • Support ATen operator _weight_int8pack_mm for Intel GPU (#​160938)
  • Extend SYCL support in PyTorch CPP Extension API to allow users to implement new custom operators on Windows (#​162579)
  • Add API torch.xpu.get_per_process_memory_fraction for Intel GPU (#​165511)
  • Add API torch.xpu.set_per_process_memory_fraction for Intel GPU (#​165510)
  • Add API torch.xpu.is_tf32_supported for Intel GPU (#​163141)
  • Add API torch.xpu.can_device_access_peer for Intel GPU (#​162705)
  • Add API torch.accelerator.get_memory_info for Intel GPU (#​162564)

Improvements

Build Frontend

Composability

  • If you are using the torch.compile(backend="aot_eager") backend, it should now give bitwise equivalent results in eager. Previously it sometimes would not due to extra compile-only decompositions running (#​165910)
  • Some dynamic shape errors were changed to recommend using torch._check over torch._check_is_size (#​164889,
  • Some unbacked (dynamic shape) improvements (#​162652, #​169612)
  • Some bugfixes for symbolic float handling in compile (#​166573, #​162788)

C++ Frontend

CUDA

  • Make torch.cuda.rng_set_state and torch.cuda.rng_get_state work in CUDA graph capture. (#​162505)
  • Enable templated kernels (#​162875)
  • Enable pre-compiled kernels (#​162972)
  • Add CUDA headers automatically (#​162634)
  • Remove outdated header_code argument (#​163165)
  • Prevent copies of std::vector in CUDA ForeachOps (#​163416)
  • Implement cuda-python CUDA stream protocol (#​163614)
  • Remove outdated checks and docs for cuBLAS determinism (#​161749)
  • Cleanup old workaround code in launch_logcumsumexp_cuda_kernel (#​164567)
  • Add a compile-time flag to trigger verbose logging for device-side asserts (#​166171)
  • Support SM 10.3 in custom CUTLASS matmuls (#​162956)
  • Enable CUTLASS matmuls on Thor (#​164836)
  • Add per_process_memory_fraction option to PYTORCH_CUDA_ALLOC_CONF (#​161035)
  • Support nested memory pools (#​168382)
  • Upgrade cuDNN to 9.15.1 for CUDA 13 builds (#​169412)

Distributed

Dynamo

  • Turn on capture_scalar_outputs and capture_dynamic_output_shape_ops when fullgraph=True (#​163121, #​163123)

  • Improved tracing for dict key hashing (#​169204)

  • Tracing support for torch.cuda.stream (#​166472)

  • Improved tracing of torch.autograd.Functions (#​166788)

  • Miscellaneous smaller tracing support additions:

  • Extend collections.defaultdict support with *args, **kwargs and custom default_factory (#​166793)

  • Support for bitwise xor (#​166065)

  • Support repr on user-defined objects (#​167372)

  • Support new typing union syntax X | Y (#​166599)

Export

  • Improved fake tensor leakage detection in export (#​163516)
  • Improved support for tensor subclasses (#​163770)

FX

  • Add tensor subclass printing support in fx/graph.py (#​164403)
  • Update Node.is_impure check if subgraph contains impure ops (#​166609, #​167443)
  • Explicitly remove call_mod_node_to_replace after inlining the submodule in const_fold._inline_module` (#​166871)
  • Add strict argument validation to Interpreter.boxed_run (#​166784)
  • Use stable topological sort in fuse_by_partitions (#​167397)

Inductor

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title Update dependency torch to v1.13.1 [SECURITY] Update dependency torch to v2 [SECURITY] Jul 25, 2024
@renovate
renovate Bot force-pushed the renovate/pypi-torch-vulnerability branch from dce35b2 to 52f3197 Compare July 25, 2024 14:06
@renovate
renovate Bot force-pushed the renovate/pypi-torch-vulnerability branch from 52f3197 to 155a951 Compare April 18, 2025 19:23
@renovate renovate Bot changed the title Update dependency torch to v2 [SECURITY] Update dependency torch to v2 [SECURITY] - autoclosed May 30, 2025
@renovate renovate Bot closed this May 30, 2025
@renovate
renovate Bot deleted the renovate/pypi-torch-vulnerability branch May 30, 2025 21:44
@renovate renovate Bot changed the title Update dependency torch to v2 [SECURITY] - autoclosed Update dependency torch to v2 [SECURITY] Jun 4, 2025
@renovate renovate Bot reopened this Jun 4, 2025
@renovate
renovate Bot force-pushed the renovate/pypi-torch-vulnerability branch 2 times, most recently from 155a951 to 6bed15b Compare June 4, 2025 20:39
@renovate
renovate Bot force-pushed the renovate/pypi-torch-vulnerability branch from 6bed15b to 950f4c2 Compare September 2, 2025 16:32
@renovate
renovate Bot force-pushed the renovate/pypi-torch-vulnerability branch from 950f4c2 to 699e8e3 Compare June 10, 2026 21:41
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants