PT-2025-39423 · Facebook+1 · Pytorch+1

Published 2025-04-17 · Updated 2025-12-06 · CVE-2025-55560

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions pytorch version 2.7.0

Description A flaw exists in pytorch that can result in a Denial of Service (DoS). This occurs when a PyTorch model incorporates both torch.Tensor.to sparse() and torch.Tensor.to dense() and is compiled using Inductor. The issue is related to the interaction between sparse and dense tensor conversions during compilation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

AZL-67944

AZL-67968

BDU:2025-12837

BIT-PYTORCH-2025-55560

CVE-2025-55560

PYSEC-2025-209

Affected Products

Debian

Pytorch

References · 18

• https://github.com/pytorch/pytorch/pull/151897 · Patch
• https://bdu.fstec.ru/vul/2025-12837 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-55560 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-pytorch-2025-55560 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-55560 · Security Note
• https://osv.dev/vulnerability/AZL-67968 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-209 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-55560 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-55560 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-67944 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-55560 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55560 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55560 · Security Note
• https://github.com/pytorch/pytorch/issues/151522 · Note
• https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc · Note