Description
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs due to improper handling of unexpected state values, which results in the server shutting down.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lightning-ai | lightning-ai/pytorch-lightning | unspecified – ≤ latest | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | lightning | <= 2.3.2 | — | PYSEC-2026-3971 |
| PyPI | pytorch-lightning | <= 2.3.2 | — | GHSA-98fp-7v67-4v3q |
Advisories 1
- WID-SEC-2025-0623 PyTorch: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 23, 2025