CVE-2025-55553 Overview
CVE-2025-55553 is a denial-of-service vulnerability in PyTorch v2.7.0. The flaw resides in the proxy_tensor.py component of the Linux Foundation's PyTorch deep learning framework. A syntax error within this component allows attackers to trigger an unhandled exception, resulting in a Denial of Service (DoS) condition. The weakness is tracked under [CWE-248: Uncaught Exception]. PyTorch is widely deployed for machine learning workloads in research and production, including model training pipelines, inference servers, and AI-as-a-service platforms. Applications that pass attacker-controlled input through affected tracing or symbolic execution paths are exposed to availability impact.
Critical Impact
Attackers can crash PyTorch-backed services by triggering the proxy_tensor.py defect, disrupting machine learning inference and training availability without requiring authentication.
Affected Products
- Linux Foundation PyTorch v2.7.0
- PyTorch Python distributions containing proxy_tensor.py
- Downstream applications and services embedding affected PyTorch builds
Discovery Timeline
- 2025-09-25 - CVE-2025-55553 published to NVD
- 2025-10-03 - Last updated in NVD database
Technical Details for CVE-2025-55553
Vulnerability Analysis
The vulnerability exists in proxy_tensor.py, a core component of PyTorch's tracing and symbolic execution infrastructure. The proxy tensor system intercepts tensor operations to construct computation graphs used by torch.fx, torch.compile, and related tracing utilities. A syntax-level defect in the component causes the Python interpreter to raise an uncaught exception when specific inputs reach the affected code path. The flaw is categorized under [CWE-248: Uncaught Exception].
When the exception propagates without handling, the executing process terminates. For long-running services such as model servers, batch training jobs, or inference APIs, this terminates the workload and forces a restart. Repeated triggering produces sustained availability degradation.
Root Cause
The root cause is a defect in proxy_tensor.py that produces an exception under conditions the surrounding code does not validate or catch. The upstream fix is tracked in PyTorch Pull Request #154645 and discussed in GitHub Issue #151432. The patch corrects the faulty handling so that affected operations no longer raise the uncaught exception during proxy tensor processing.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker submits crafted tensor inputs or model artifacts to a service that invokes the affected proxy tensor logic. Common exposure points include hosted inference endpoints, model compilation services, and pipelines that compile user-supplied model code with torch.compile. Successful exploitation crashes the worker process and denies service to legitimate users. Confidentiality and integrity are not affected; only availability is impacted. A reference reproducer is available in the GitHub Gist code snippet linked from the advisory.
Detection Methods for CVE-2025-55553
Indicators of Compromise
- Repeated Python tracebacks in service logs referencing proxy_tensor.py or torch.fx tracing functions.
- Unexpected process terminations or container restarts on PyTorch inference and training workers.
- Spikes in 5xx responses or worker restarts correlated with model compilation or tracing requests.
Detection Strategies
- Inspect torch version metadata across hosts and containers to identify deployments running PyTorch v2.7.0.
- Monitor application logs for stack traces originating in proxy_tensor.py and correlate with request payloads.
- Add input validation telemetry around endpoints that invoke torch.compile, torch.fx.symbolic_trace, or proxy tensor execution paths.
Monitoring Recommendations
- Track process restart counts and exit codes on machine learning worker nodes.
- Alert on sustained traceback patterns referencing the affected component across multiple workers.
- Capture inbound model artifacts and tensor inputs to support post-incident analysis of crash-inducing payloads.
How to Mitigate CVE-2025-55553
Immediate Actions Required
- Inventory all systems, containers, and virtual environments running PyTorch v2.7.0 and prioritize upgrade.
- Upgrade PyTorch to a version that includes the fix from PyTorch Pull Request #154645.
- Restrict network exposure of inference and model compilation endpoints to authenticated clients where feasible.
- Apply rate limiting and request size limits on endpoints that invoke tracing or compilation logic.
Patch Information
The upstream fix is published in PyTorch Pull Request #154645. Upgrade to a PyTorch release that incorporates this commit. Validate the upgrade in staging environments and confirm that downstream model code remains compatible with the patched proxy tensor behavior.
Workarounds
- Wrap calls to torch.compile and torch.fx tracing in exception handlers so that crashes do not terminate worker processes.
- Use process supervisors or container orchestration policies to auto-restart workers and contain availability impact.
- Validate and sanitize tensor shapes, dtypes, and model graphs received from untrusted sources before invoking tracing.
# Configuration example: upgrade PyTorch to a patched release
pip install --upgrade torch
python -c "import torch; print(torch.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
