PyPI package
torch vulnerabilities by version
The latest release, 2.14.1 (Sep 30, 2026), has no known vulnerabilities. 7 of the 10 most recent releases have known vulnerabilities. OSV.dev lists 31 advisories for torch; the newest was published on Mar 22, 2026.
PyPI (opens in a new tab) describes it as “Tensors and Dynamic neural networks in Python with strong GPU acceleration”
- Latest release
- 2.14.1
- Sep 30, 2026, no known vulnerabilities
- Downloads last week
- 13.1M
- All versions, from pypistats.org
- Advisories on OSV.dev
- 31
- Newest Mar 22, 2026
- Licence
- Apache-2.0 AND Apache-2.0 WITH LLVM-exception AND BSD-2-Clause AND BSD-3-Clause AND BSL-1.0 AND MIT
Recent releases
PyPI doesn’t publish downloads per version, so these are the newest releases, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.
Release lines
The newest release of each minor line, from the registry. torch doesn’t publish support dates we can check.
Newest advisories
The 5 most recently published, with the versions each one affects.
WarningCVE-2026-4538 on OSV.dev (opens in a new tab)PYSEC-2026-139
A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserialization. The attack can only be p…
Affects <= 2.10.0. Published Mar 22, 2026.
WarningCVE-2026-24747 on OSV.dev (opens in a new tab)GHSA-63cw-57p8-fm3p
PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`…
Affects < 2.10.0. Published Jan 27, 2026.
WarningCVE-2025-63396 on OSV.dev (opens in a new tab)PYSEC-2025-210
An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finalization, leading to a Denial of Service (D…
Affects <= 2.5.0-NA. Published Nov 12, 2025.
WarningCVE-2025-55560 on OSV.dev (opens in a new tab)PYSEC-2025-209
An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is compiled by Inductor.
Affects < 2.7.1. Published Sep 25, 2025.
WarningCVE-2025-55558 on OSV.dev (opens in a new tab)PYSEC-2025-208
A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() and is compiled by Inductor, leading to a…
Affects < 2.7.1. Published Sep 25, 2025.
All 31 advisories are on OSV.dev (opens in a new tab).
Which torch do you have?
Paste a public GitHub repo or drop your requirements.txt or pyproject.toml and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.
How this page is checked
StackPrism reads every OSV.dev advisory for torch, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from pypistats.org. No AI writes this page: every sentence comes from that data, refreshed every few hours.
Last checked against OSV.dev, CISA KEV, PyPI, pypistats.org and deps.dev.