CVE-2025-3730: PyTorch denial of service in ctc_loss via local manipulation

Summary

A problematic vulnerability in PyTorch 2.6.0 affects the function torch.nn.functional.ctc_loss in aten/src/ATen/native/LossCTC.cpp. Manipulating it leads to denial of service, and an attack must be carried out locally. The exploit is public, though the vulnerability's real existence is still doubted.

Mitigation

It is recommended to apply the patch 46fc5d8e360127361211cb237d5f9eef0223e567 to fix this issue.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• torchPyPINo LLM dependency detected · 200 tracked dependents

Related items

• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence
• InfoThe Blind Spots of Detection: Adversarial Perturbation Attacks against Watchdogs in Distributed LLM InferenceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• HighCVE-2026-118761: Kubeflow Pipelines decompression bomb in pipeline archive uploadSimilar attack · NVD/CVE Database
• LowOpenCode User Hit with Hostile Backlash After Reporting Free AI LoopholeSimilar attack · Socket Blog