{"data":{"id":"023a67f0-ae17-4db0-8d2e-35f19c5c56b7","title":"CVE-2024-35199: TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected…","summary":"CVE-2024-35199 affects TorchServe versions where the two gRPC ports 7070 and 7071 are not bound to localhost by default. When TorchServe starts, both interfaces listen on all interfaces. PyTorch inference Deep Learning Containers used through Amazon SageMaker and EKS are not affected.","solution":"This issue has been fixed in PR #3083, and TorchServe release 0.11.0 includes the fix. Users are advised to upgrade. There are no known workarounds.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-35199","publishedAt":"2024-07-19T06:15:14.777Z","cveId":"CVE-2024-35199","cweIds":["CWE-668"],"cvssScore":"8.2","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["torchserve@>= 0.3.0, < 0.11.0 (fixed: 0.11.0)"],"affectedPackageNames":["torchserve"],"affectedPackageRefs":["pypi:torchserve"],"affectedVendors":[],"affectedVendorsRaw":["TorchServe","PyTorch","Amazon SageMaker"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"TorchServe gRPC ports exposed on all interfaces by default","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00637,"epssCheckedAt":"2026-11-04T18:09:12.821Z","kevDateAdded":null,"advisoryAliases":["GHSA-hhpg-v63p-wp7w"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:32.283Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-05-16T18:10:47.713Z","daysToFix":-64,"fixCheckedAt":"2026-10-29T21:45:40.160Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"torchserve","fixedVersion":"0.11.0","matchedVersion":"0.11.0","fixReleasedAt":"2024-05-16T18:10:47.713Z","daysToFix":-64,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:40.009Z"}]}}