CVE-2024-8020

Denial of Service in lightning-ai/pytorch-lightning

State: Published
Severity: 7.5 High
Published: Mar 20, 2025
Updated: Oct 15, 2025
Reserved: Aug 20, 2024

Description

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs due to improper handling of unexpected state values, which results in the server shutting down.

Scores

CVSS	Score	Vector	Source
3.0	7.5 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	@huntr_ai

Weaknesses

CWE-248 Uncaught Exception

Affected Products

Product	Versions
lightning-ai/pytorch-lightninglightning-ai	latest and earlierAffected

References

https://huntr.com/bounties/8b642a78-2b80-4fb0-9b2f-8ba0ff37db6a

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.