CVE-2024-35199 - CVE House
Back to Database
Status published High CVE-2024-35199

TorchServe gRPC Port Exposure

Vulnerability Description

TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and 7071, are not bound to [localhost](http://localhost/) by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed in PR #3083. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-35199

Credits & Attribution

No credits recorded in the NVD database.

References

More from pytorch

View All →
CVE-2025-32434
PyTorch: `torch.load` with `weights_only=True` leads to remote code execution
Critical 9.3
CVE-2024-6577
Unclaimed S3 Bucket Usage in pytorch/serve
Medium 6.3
CVE-2024-35198
TorchServe bypass allowed_urls configuration
Critical 9.8
CVE-2023-48299
TorchServe ZipSlip
Medium 5.3
CVE-2023-43654
TorchServe Server-Side Request Forgery
Critical 10

Affected Vendor

Affected Software

serve
Vulnerable Versions:
>= 0.3.0, < 0.11.0

Timeline

Official Publish: July 18th, 2024
Last Modified: August 7th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weaknesses (CWE)

CWE-668

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1078 Valid Accounts
Persistence