Skip to content
Heist/ feed
Back to feed
Medium

PyTorch nccl.py torch.cuda.nccl.reduce denial of service

Type: advisorySources: OSV

A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function torch.cuda.nccl.reduce of the file torch/cuda/nccl.py. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. It is recommended to apply a patch to fix this issue.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-4287
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 15:02 UTC · Revision 1

Source evidence

PyTorch nccl.py torch.cuda.nccl.reduce denial of service

core-osv · Original source

Published 5 May 2025, 20:00 UTC

A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function torch.cuda.nccl.reduce of the file torch/cuda/nccl.py. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. It is recommended to apply a patch to fix this issue.

osv:CVE-2025-4287
Complete source record
{
  "id": "35836f71d8d87bf0aa851e5fb7cac5e4f3c24afc0601cced9e3f6be8dd4f1ac0",
  "url": "https://osv.dev/vulnerability/CVE-2025-4287",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "PyTorch nccl.py torch.cuda.nccl.reduce denial of service",
    "summary": "A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function torch.cuda.nccl.reduce of the file torch/cuda/nccl.py. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. It is recommended to apply a patch to fix this issue.",
    "evidence": "osv:CVE-2025-4287",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2025-4287",
      "aliases": [
        "CVE-2025-4287"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/divigroup-rap/pytorch",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "5827d2061dcb4acd05ac5f8e65d8693a481ba0f5"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "fixed": "5827d2061dcb4acd05ac5f8e65d8693a481ba0f5"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "ciflow/periodic/ed0dea3e24a2ba4d01043c4cfd27e90655692adc",
            "cslpull90",
            "cslpull89",
            "cslpull91",
            "cslpull92",
            "cslpull88",
            "cslpull86",
            "cslpull87",
            "cslpull81",
            "cslpull84",
            "cslpull85",
            "cslpull76",
            "cslpull77",
            "cslpull82",
            "cslpull83",
            "cslpull80",
            "cslpull78",
            "cslpull79",
            "cslpull75",
            "forpull1",
            "ciflow/unstable/123",
            "bc2caa7fdf006894eff7af936babde69ab5a40f8-huydhn-debug",
            "ciflow/periodic/3e98831",
            "ciflow/slow/da3aba1e46157c4df504b067477cdf2b3c96b194-sdym",
            "ciflow/slow/0d5b74da0cab798fbfdb9caa53fad816999c8386-sdym",
            "ciflow/slow/8751002215790a3a88750faa8f4366933e296693-sdym",
            "ciflow/slow/a837609",
            "ciflow/slow/788ff06",
            "ciflow/slow/1faef89",
            "ciflow/slow/187eb7c",
            "ciflow/slow/01c7106",
            "ciflow/slow/3920ec1",
            "ciflow/slow/0577043",
            "ciflow/slow/a206e8b",
            "ciflow/slow/59a3759",
            "ciflow/slow/1732077",
            "ciflow/slow/9d85864",
            "ciflow/slow/0e81104",
            "ciflow/slow/3b7c6b2",
            "ciflow/slow/70ef0bb",
            "ciflow/slow/af841f3",
            "ciflow/slow/9ffad5b",
            "ciflow/periodic/94512-point",
            "ciflow/inductor/3d4b92b",
            "ciflow/inductor/3b9a386",
            "ciflow/inductor/d224ac7",
            "ciflow/periodic/csl/test87519",
            "ciflow/periodic/csltest88761",
            "ciflow/periodic/csltest88275",
            "ciflow/periodic/317eeb8",
            "ciflow/periodic/2a6d37d",
            "ciflow/periodic/3c32",
            "ciflow/periodic/054a2fd",
            "ciflow/periodic/sha-ec5b83",
            "malfet/tag-2ef5611",
            "malfet/tag-317b1a0",
            "malfet/tag-ec6f767",
            "nightly-binary",
            "v1.8.0-rc1",
            "v1.4.0a0",
            "v1.3.0a0",
            "v1.2.0a0",
            "v1.1.0a0",
            "v1.0rc1",
            "v1.0rc0",
            "v1.0.0a0",
            "v0.1.11",
            "v0.1.10",
            "v0.1.9",
            "v0.1.8",
            "v0.1.7",
            "v0.1.6",
            "v0.1.5",
            "v0.1.4",
            "v0.1.3",
            "v0.1.2",
            "v0.1.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4287.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:30.005151578Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4287.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-4287",
        "https://vuldb.com/?id.307394",
        "https://vuldb.com/?submit.553644",
        "https://github.com/pytorch/pytorch/issues/150836",
        "https://github.com/pytorch/pytorch/issues/150836#issue-2979097872",
        "https://github.com/pytorch/pytorch/pull/150923",
        "https://vuldb.com/?ctiid.307394",
        "https://github.com/Divigroup-RAP/PYTORCH/commit/5827d2061dcb4acd05ac5f8e65d8693a481ba0f5"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-404"
        ],
        "cna_assigner": "VulDB",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "2.6.0+cu124"
                  },
                  {
                    "last_affected": "2.6.0+cu124"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandaloneSingleVersion"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4287.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-4287",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 496638,
  "published_at": "2025-05-05T20:00:11.13+00:00"
}