CVE-2024-8020 - CVE House
Back to Database
Status published High CVE-2024-8020

Denial of Service in lightning-ai/pytorch-lightning

Vulnerability Description

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs due to improper handling of unexpected state values, which results in the server shutting down.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8020

Credits & Attribution

No credits recorded in the NVD database.

References

More from lightning-ai

View All →
CVE-2024-8019
Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning
Critical 9.1
CVE-2024-5980
Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning
Critical 9.1
CVE-2024-5452
RCE via Property/Class Pollution in lightning-ai/pytorch-lightning
Critical 9.8

Affected Vendor

lightning-ai

View all reports →

Affected Software

lightning-ai/pytorch-lightning
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: October 15th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-248

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1203 Exploitation for Client Execution
Execution
T1213 Data from Information Repositories
Collection
T1499.003 Application Exhaustion Flood
Impact