{"action":"Upgrade torchserve to 0.11.0 or later.","affected":[{"fixed":"0.11.0","introduced":"0"}],"component":"torchserve","cve_ids":["CVE-2024-35198"],"ecosystem":"PyPI","epss":0.00799,"exploited":false,"fixed_versions":["0.11.0"],"ghsa_id":"GHSA-wxcx-gg9c-fwp2","id":"tcs_01M5KG32K6R4Q3KASGSQ1A8TS7","modified_at":"2026-09-10T03:50:17.056932446Z","published_at":"2024-07-18T22:03:30Z","references":["https://osv.dev/vulnerability/GHSA-wxcx-gg9c-fwp2","https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2","https://nvd.nist.gov/vuln/detail/CVE-2024-35198","https://github.com/pytorch/serve/pull/3082","https://github.com/pytorch/serve/commit/cdba0fd449c2fd23dcf37c54c0784035541d5114","https://github.com/pytorch/serve","https://github.com/pytorch/serve/releases/tag/v0.11.0"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-wxcx-gg9c-fwp2","url":"https://osv.dev/vulnerability/GHSA-wxcx-gg9c-fwp2"}],"summary":"TorchServe vulnerable to bypass of allowed_urls configuration"}