{"id":"CVE-2024-8020","aliases":["GHSA-98fp-7v67-4v3q","PYSEC-2026-1857","PYSEC-2026-3971"],"title":"PyTorch Lightning denial of service vulnerability","summary":"PyTorch Lightning denial of service vulnerability","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"pytorch-lightning","product":"pytorch-lightning","ecosystem":"pip","affected":["pytorch-lightning <= 2.3.2"],"published":"2025-03-20","updated":"2026-09-10","sourceUpdated":"2026-09-10T17:25:34.335699774Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-98fp-7v67-4v3q","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8020"},{"url":"https://github.com/Lightning-AI/pytorch-lightning"},{"url":"https://huntr.com/bounties/8b642a78-2b80-4fb0-9b2f-8ba0ff37db6a"},{"url":"https://pypi.org/project/pytorch-lightning"},{"url":"https://github.com/advisories/GHSA-98fp-7v67-4v3q"}],"tags":["osv","pip"],"epss":0.00629,"epssPercentile":0.48783,"ingestedAt":"2026-07-08T18:25:47.798Z","slug":"CVE-2024-8020","body":"## Overview\n\nA vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs due to improper handling of unexpected state values, which results in the server shutting down.\n\n## Affected packages\n\n- `pytorch-lightning <= 2.3.2`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}