---
id: CVE-2024-8020
aliases:
  - GHSA-98fp-7v67-4v3q
  - PYSEC-2026-1857
  - PYSEC-2026-3971
title: PyTorch Lightning denial of service vulnerability
summary: PyTorch Lightning denial of service vulnerability
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: pytorch-lightning
product: pytorch-lightning
ecosystem: pip
affected:
  - pytorch-lightning <= 2.3.2
published: '2025-03-20'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T17:25:34.335699774Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-98fp-7v67-4v3q'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-8020'
  - url: 'https://github.com/Lightning-AI/pytorch-lightning'
  - url: 'https://huntr.com/bounties/8b642a78-2b80-4fb0-9b2f-8ba0ff37db6a'
  - url: 'https://pypi.org/project/pytorch-lightning'
  - url: 'https://github.com/advisories/GHSA-98fp-7v67-4v3q'
tags:
  - osv
  - pip
epss: 0.00629
epssPercentile: 0.48814
ingestedAt: '2026-07-08T18:25:47.798Z'
---

## Overview

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs due to improper handling of unexpected state values, which results in the server shutting down.

## Affected packages

- `pytorch-lightning <= 2.3.2`

## Remediation

Refer to the advisory for the patched release.