gavindiaz/NexQuant
1
0
Fork 0
mirror of https://github.com/NicolasBohn/NexQuant.git synced 2026-07-27 15:37:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: Update torch to 2.8.0 (CVE-2025-3730 fix)

Browse Source 
- Upgrade torch from >=2.6.0 to >=2.8.0
- Fixes CVE-2025-3730: DoS in torch.nn.functional.ctc_loss
- Vulnerability in LossCTC.cpp leads to denial of service
- Local attack with low complexity, requires low privileges
- Also fixes CVE-2025-32434 (torch.load RCE)

Fixes Dependabot Alert #34
This commit is contained in:
TPTBusiness
2026-04-02 23:00:28 +02:00
parent e393339cbe
commit 31ad73b531
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rdagent/scenarios/rl/autorl_bench/requirements.txt
+1 -1
View File
@@ -24,7 +24,7 @@ pydantic>=2.4.0 # Security fix: CVE-2024-3772 (ReDoS via crafted email)
# Models
# Security: transformers >=4.51.0 fixes CVE-2025-3263 (ReDoS in get_configuration_file)
# Current spec (>=4.53.0) is already safe. Dependabot alert is false positive due to missing lockfile.
torch>=2.6.0 # Security fix: CVE-2025-32434 (torch.load RCE with weights_only=True)
torch>=2.8.0 # Security fix: CVE-2025-32434 (torch.load RCE), CVE-2025-3730 (DoS in ctc_loss)
transformers>=4.53.0 # Security fix: CVE-2024-11393 (RCE), CVE-2025-3264/3933/2099/6051 (ReDoS)
huggingface_hub>=0.20.0