{"cve":"CVE-2024-35199","nvd":{"published":"2024-07-19T02:15:14.777","modified":"2026-06-17T07:34:31.690","status":"Analyzed","description":"TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and 7071, are not bound to [localhost](http://localhost/) by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed in PR #3083. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","score":8.2},"cwes":["CWE-668"],"references":["https://github.com/pytorch/serve/pull/3083","https://github.com/pytorch/serve/releases/tag/v0.11.0","https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w","https://github.com/pytorch/serve/pull/3083","https://github.com/pytorch/serve/releases/tag/v0.11.0"],"products":["pytorch:torchserve"],"source":"nvd","synced_at":"2026-10-19T21:52:42.518321223+00:00"},"epss":{"cve":"CVE-2024-35199","score":0.00637,"percentile":0.50529,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hhpg-v63p-wp7w","url":"https://osv.dev/vulnerability/GHSA-hhpg-v63p-wp7w","summary":"TorchServe gRPC Port Exposure","modified":"2026-09-10T03:50:16.759094781Z","packages":[{"ecosystem":"PyPI","name":"torchserve","purl":"pkg:pypi/torchserve","ranges":[">=0.3.0 <0.11.0"],"fixed":["0.11.0"]}]},{"id":"PYSEC-2026-1971","url":"https://osv.dev/vulnerability/PYSEC-2026-1971","summary":"TorchServe gRPC Port Exposure","modified":"2026-07-07T17:48:11.504059076Z","packages":[{"ecosystem":"PyPI","name":"torchserve","purl":"pkg:pypi/torchserve","ranges":[">=0.3.0 <0.11.0"],"fixed":["0.11.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}