{"id":"CVE-2024-35199","aliases":["GHSA-hhpg-v63p-wp7w","PYSEC-2026-1971"],"url":"https://o3.security/vulnerability/CVE-2024-35199","summary":"TorchServe gRPC Port Exposure","details":"### Impact\nThe two gRPC ports 7070 and 7071, are not bound to [localhost](http://localhost/) by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected.\n\n### Patches\nThis issue in TorchServe has been fixed in [#3083](https://github.com/pytorch/serve/pull/3083).\n\nTorchServe release 0.11.0 includes the fix to address this vulnerability.\n\n### References\n* [#3083](https://github.com/pytorch/serve/pull/3083)\n* [TorchServe release v0.11.0](https://github.com/pytorch/serve/releases/tag/v0.11.0)\n\nThank Kroll Cyber Risk for for responsibly disclosing this issue.\n\nIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.","published":"2024-07-18T22:40:06.549Z","modified":"2026-08-12T03:51:26.361153225Z","cvss":{"score":8.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"torchserve","fixedVersion":"0.11.0"}],"fix":{"url":"https://github.com/pytorch/serve/pull/3083","label":"pytorch/serve#3083"},"references":[{"type":"WEB","url":"https://github.com/pytorch/serve/releases/tag/v0.11.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35199.json"},{"type":"ADVISORY","url":"https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35199"},{"type":"FIX","url":"https://github.com/pytorch/serve/pull/3083"},{"type":"WEB","url":"https://github.com/pytorch/serve/commit/aab99506a17193de217aacc1119d9381dbc6ed2b"},{"type":"PACKAGE","url":"https://github.com/pytorch/serve"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:26.361153225Z"}}