{"schema_version":"2","view":"grouped","data":[{"id":52719,"cve_ids":["CVE-2026-114052"],"payload":{"kind":"advisory","title":"vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs","summary":"vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.","evidence":"cve:CVE-2026-114052","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114052","aliases":["CVE-2026-114052"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0.25.0","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-22T18:16:55.772Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-823j-m4cj-hmjf","https://www.vulncheck.com/advisories/vllm-0.25.0-before-0.31.0-moss-audio-memory-exhaustion-via-tokenize-mm-processor-kwargs"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114052","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-22T18:16:43.778221Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-22T18:16:55.772Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:29.076Z"}}},"related_cves":[{"value":"CVE-2026-114052","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f351d5c0-e62d-43b8-a825-cb4bff69d308","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114052","advisory_id":"f351d5c0-e62d-43b8-a825-cb4bff69d308","event_types":["advisory"],"published_at":"2026-10-25T14:41:55.641763+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:29.076+00:00","detail_url":"/advisories/advisory%3Af351d5c0-e62d-43b8-a825-cb4bff69d308","group":{"id":"advisory:f351d5c0-e62d-43b8-a825-cb4bff69d308","revision":1,"primary_event_id":52247,"change":"published","superseded_by":[],"changed":{"id":52247,"cve_ids":["CVE-2026-114052"],"payload":{"kind":"advisory","title":"vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs","summary":"vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.","evidence":"cve:CVE-2026-114052","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114052","aliases":["CVE-2026-114052"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0.25.0","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-22T18:16:55.772Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-823j-m4cj-hmjf","https://www.vulncheck.com/advisories/vllm-0.25.0-before-0.31.0-moss-audio-memory-exhaustion-via-tokenize-mm-processor-kwargs"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114052","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-22T18:16:43.778221Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-22T18:16:55.772Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:29.076Z"}}},"related_cves":[{"value":"CVE-2026-114052","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f351d5c0-e62d-43b8-a825-cb4bff69d308","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114052","advisory_id":"f351d5c0-e62d-43b8-a825-cb4bff69d308","event_types":["advisory"],"published_at":"2026-10-25T14:41:55.641763+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:29.076+00:00","detail_url":"/events/52247"},"members":[{"id":52247,"cve_ids":["CVE-2026-114052"],"payload":{"kind":"advisory","title":"vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs","summary":"vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.","evidence":"cve:CVE-2026-114052","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114052","aliases":["CVE-2026-114052"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0.25.0","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-22T18:16:55.772Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-823j-m4cj-hmjf","https://www.vulncheck.com/advisories/vllm-0.25.0-before-0.31.0-moss-audio-memory-exhaustion-via-tokenize-mm-processor-kwargs"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114052","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-22T18:16:43.778221Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-22T18:16:55.772Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:29.076Z"}}},"related_cves":[{"value":"CVE-2026-114052","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f351d5c0-e62d-43b8-a825-cb4bff69d308","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114052","advisory_id":"f351d5c0-e62d-43b8-a825-cb4bff69d308","event_types":["advisory"],"published_at":"2026-10-25T14:41:55.641763+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:29.076+00:00","detail_url":"/events/52247"}]}},{"id":49701,"cve_ids":["CVE-2026-114055"],"payload":{"kind":"advisory","title":"vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs","summary":"vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server.","evidence":"cve:CVE-2026-114055","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114055","aliases":["CVE-2026-114055"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0.7.3","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T15:50:46.285Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-gx7p-2j49-hfq4","https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-dos-via-unvalidated-mm-processor-kwargs"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114055","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T14:40:33.947720Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T15:50:46.285Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:31.227Z"}}},"related_cves":[{"value":"CVE-2026-114055","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:23835d6a-4d29-4f42-b3bf-be8a9b5770a0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114055","advisory_id":"23835d6a-4d29-4f42-b3bf-be8a9b5770a0","event_types":["advisory"],"published_at":"2026-10-25T13:46:26.262233+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:31.227+00:00","detail_url":"/advisories/advisory%3A23835d6a-4d29-4f42-b3bf-be8a9b5770a0","group":{"id":"advisory:23835d6a-4d29-4f42-b3bf-be8a9b5770a0","revision":1,"primary_event_id":49229,"change":"published","superseded_by":[],"changed":{"id":49229,"cve_ids":["CVE-2026-114055"],"payload":{"kind":"advisory","title":"vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs","summary":"vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server.","evidence":"cve:CVE-2026-114055","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114055","aliases":["CVE-2026-114055"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0.7.3","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T15:50:46.285Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-gx7p-2j49-hfq4","https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-dos-via-unvalidated-mm-processor-kwargs"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114055","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T14:40:33.947720Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T15:50:46.285Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:31.227Z"}}},"related_cves":[{"value":"CVE-2026-114055","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:23835d6a-4d29-4f42-b3bf-be8a9b5770a0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114055","advisory_id":"23835d6a-4d29-4f42-b3bf-be8a9b5770a0","event_types":["advisory"],"published_at":"2026-10-25T13:46:26.262233+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:31.227+00:00","detail_url":"/events/49229"},"members":[{"id":49229,"cve_ids":["CVE-2026-114055"],"payload":{"kind":"advisory","title":"vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs","summary":"vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server.","evidence":"cve:CVE-2026-114055","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114055","aliases":["CVE-2026-114055"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0.7.3","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T15:50:46.285Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-gx7p-2j49-hfq4","https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-dos-via-unvalidated-mm-processor-kwargs"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114055","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T14:40:33.947720Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T15:50:46.285Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:31.227Z"}}},"related_cves":[{"value":"CVE-2026-114055","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:23835d6a-4d29-4f42-b3bf-be8a9b5770a0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114055","advisory_id":"23835d6a-4d29-4f42-b3bf-be8a9b5770a0","event_types":["advisory"],"published_at":"2026-10-25T13:46:26.262233+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:31.227+00:00","detail_url":"/events/49229"}]}},{"id":49700,"cve_ids":["CVE-2026-114050"],"payload":{"kind":"advisory","title":"vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID","summary":"vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.","evidence":"cve:CVE-2026-114050","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114050","aliases":["CVE-2026-114050"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T15:50:53.921Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-p92p-rxj5-7p2x","https://www.vulncheck.com/advisories/vllm-before-0.31.0-remote-engine-crash-via-forged-multimodal-uuid"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114050","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T14:24:53.707222Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T15:50:53.921Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:27.641Z"}}},"related_cves":[{"value":"CVE-2026-114050","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7b88ba0a-ca1c-4cbd-9efc-bc674b2909df","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114050","advisory_id":"7b88ba0a-ca1c-4cbd-9efc-bc674b2909df","event_types":["advisory"],"published_at":"2026-10-25T13:46:25.427797+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:27.641+00:00","detail_url":"/advisories/advisory%3A7b88ba0a-ca1c-4cbd-9efc-bc674b2909df","group":{"id":"advisory:7b88ba0a-ca1c-4cbd-9efc-bc674b2909df","revision":1,"primary_event_id":49228,"change":"published","superseded_by":[],"changed":{"id":49228,"cve_ids":["CVE-2026-114050"],"payload":{"kind":"advisory","title":"vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID","summary":"vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.","evidence":"cve:CVE-2026-114050","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114050","aliases":["CVE-2026-114050"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T15:50:53.921Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-p92p-rxj5-7p2x","https://www.vulncheck.com/advisories/vllm-before-0.31.0-remote-engine-crash-via-forged-multimodal-uuid"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114050","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T14:24:53.707222Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T15:50:53.921Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:27.641Z"}}},"related_cves":[{"value":"CVE-2026-114050","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7b88ba0a-ca1c-4cbd-9efc-bc674b2909df","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114050","advisory_id":"7b88ba0a-ca1c-4cbd-9efc-bc674b2909df","event_types":["advisory"],"published_at":"2026-10-25T13:46:25.427797+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:27.641+00:00","detail_url":"/events/49228"},"members":[{"id":49228,"cve_ids":["CVE-2026-114050"],"payload":{"kind":"advisory","title":"vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID","summary":"vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.","evidence":"cve:CVE-2026-114050","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114050","aliases":["CVE-2026-114050"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T15:50:53.921Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-p92p-rxj5-7p2x","https://www.vulncheck.com/advisories/vllm-before-0.31.0-remote-engine-crash-via-forged-multimodal-uuid"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114050","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T14:24:53.707222Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T15:50:53.921Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:27.641Z"}}},"related_cves":[{"value":"CVE-2026-114050","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7b88ba0a-ca1c-4cbd-9efc-bc674b2909df","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114050","advisory_id":"7b88ba0a-ca1c-4cbd-9efc-bc674b2909df","event_types":["advisory"],"published_at":"2026-10-25T13:46:25.427797+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:27.641+00:00","detail_url":"/events/49228"}]}},{"id":45380,"cve_ids":["CVE-2026-114054"],"payload":{"kind":"advisory","title":"vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys","summary":"vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match cache_salt to a LoRA name to reuse first-block KV state.","evidence":"cve:CVE-2026-114054","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114054","aliases":["CVE-2026-114054"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T00:36:30.509Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-rh6f-3x46-j33q","https://www.vulncheck.com/advisories/vllm-before-0.31.0-cross-request-cache-aliasing-via-exif-imageid-and-prefix-cache-keys"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:30.509Z"}}},"related_cves":[{"value":"CVE-2026-114054","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f4c3e178-a011-46ed-b768-9d693f9a542e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114054","advisory_id":"f4c3e178-a011-46ed-b768-9d693f9a542e","event_types":["advisory"],"published_at":"2026-10-25T12:25:32.812651+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:30.509+00:00","detail_url":"/advisories/advisory%3Af4c3e178-a011-46ed-b768-9d693f9a542e","group":{"id":"advisory:f4c3e178-a011-46ed-b768-9d693f9a542e","revision":1,"primary_event_id":44946,"change":"published","superseded_by":[],"changed":{"id":44946,"cve_ids":["CVE-2026-114054"],"payload":{"kind":"advisory","title":"vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys","summary":"vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match cache_salt to a LoRA name to reuse first-block KV state.","evidence":"cve:CVE-2026-114054","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114054","aliases":["CVE-2026-114054"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T00:36:30.509Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-rh6f-3x46-j33q","https://www.vulncheck.com/advisories/vllm-before-0.31.0-cross-request-cache-aliasing-via-exif-imageid-and-prefix-cache-keys"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:30.509Z"}}},"related_cves":[{"value":"CVE-2026-114054","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f4c3e178-a011-46ed-b768-9d693f9a542e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114054","advisory_id":"f4c3e178-a011-46ed-b768-9d693f9a542e","event_types":["advisory"],"published_at":"2026-10-25T12:25:32.812651+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:30.509+00:00","detail_url":"/events/44946"},"members":[{"id":44946,"cve_ids":["CVE-2026-114054"],"payload":{"kind":"advisory","title":"vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys","summary":"vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match cache_salt to a LoRA name to reuse first-block KV state.","evidence":"cve:CVE-2026-114054","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114054","aliases":["CVE-2026-114054"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T00:36:30.509Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-rh6f-3x46-j33q","https://www.vulncheck.com/advisories/vllm-before-0.31.0-cross-request-cache-aliasing-via-exif-imageid-and-prefix-cache-keys"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:30.509Z"}}},"related_cves":[{"value":"CVE-2026-114054","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f4c3e178-a011-46ed-b768-9d693f9a542e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114054","advisory_id":"f4c3e178-a011-46ed-b768-9d693f9a542e","event_types":["advisory"],"published_at":"2026-10-25T12:25:32.812651+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:30.509+00:00","detail_url":"/events/44946"}]}},{"id":45379,"cve_ids":["CVE-2026-114053"],"payload":{"kind":"advisory","title":"vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision","summary":"vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.","evidence":"cve:CVE-2026-114053","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-114053","aliases":["CVE-2026-114053"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.2,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0.7.3","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T00:36:29.796Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-6mm3-gc2m","https://github.com/vllm-project/vllm/commit/570735520942b6428ae98f1eb442c6d88adae55e","https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-rce-via-mm-processor-kwargs-code-revision"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:29.796Z"}}},"related_cves":[{"value":"CVE-2026-114053","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f5491717-bc95-4ee7-a5b0-e654e33f70fd","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114053","advisory_id":"f5491717-bc95-4ee7-a5b0-e654e33f70fd","event_types":["advisory"],"published_at":"2026-10-25T12:25:32.226166+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:29.796+00:00","detail_url":"/advisories/advisory%3Af5491717-bc95-4ee7-a5b0-e654e33f70fd","group":{"id":"advisory:f5491717-bc95-4ee7-a5b0-e654e33f70fd","revision":1,"primary_event_id":44945,"change":"published","superseded_by":[],"changed":{"id":44945,"cve_ids":["CVE-2026-114053"],"payload":{"kind":"advisory","title":"vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision","summary":"vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.","evidence":"cve:CVE-2026-114053","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-114053","aliases":["CVE-2026-114053"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.2,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0.7.3","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T00:36:29.796Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-6mm3-gc2m","https://github.com/vllm-project/vllm/commit/570735520942b6428ae98f1eb442c6d88adae55e","https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-rce-via-mm-processor-kwargs-code-revision"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:29.796Z"}}},"related_cves":[{"value":"CVE-2026-114053","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f5491717-bc95-4ee7-a5b0-e654e33f70fd","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114053","advisory_id":"f5491717-bc95-4ee7-a5b0-e654e33f70fd","event_types":["advisory"],"published_at":"2026-10-25T12:25:32.226166+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:29.796+00:00","detail_url":"/events/44945"},"members":[{"id":44945,"cve_ids":["CVE-2026-114053"],"payload":{"kind":"advisory","title":"vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision","summary":"vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.","evidence":"cve:CVE-2026-114053","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-114053","aliases":["CVE-2026-114053"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.2,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0.7.3","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T00:36:29.796Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-6mm3-gc2m","https://github.com/vllm-project/vllm/commit/570735520942b6428ae98f1eb442c6d88adae55e","https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-rce-via-mm-processor-kwargs-code-revision"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:29.796Z"}}},"related_cves":[{"value":"CVE-2026-114053","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f5491717-bc95-4ee7-a5b0-e654e33f70fd","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114053","advisory_id":"f5491717-bc95-4ee7-a5b0-e654e33f70fd","event_types":["advisory"],"published_at":"2026-10-25T12:25:32.226166+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:29.796+00:00","detail_url":"/events/44945"}]}},{"id":45378,"cve_ids":["CVE-2026-114051"],"payload":{"kind":"advisory","title":"vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate","summary":"vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.","evidence":"cve:CVE-2026-114051","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114051","aliases":["CVE-2026-114051"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T00:36:28.373Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-4xqp-c3mv-qff7","https://www.vulncheck.com/advisories/vllm-before-0.31.0-denial-of-service-via-min-tokens-in-inference-v1-generate"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:28.373Z"}}},"related_cves":[{"value":"CVE-2026-114051","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3e98d400-9da0-4376-a470-c5c68bfbaee6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114051","advisory_id":"3e98d400-9da0-4376-a470-c5c68bfbaee6","event_types":["advisory"],"published_at":"2026-10-25T12:25:31.427397+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:28.373+00:00","detail_url":"/advisories/advisory%3A3e98d400-9da0-4376-a470-c5c68bfbaee6","group":{"id":"advisory:3e98d400-9da0-4376-a470-c5c68bfbaee6","revision":1,"primary_event_id":44944,"change":"published","superseded_by":[],"changed":{"id":44944,"cve_ids":["CVE-2026-114051"],"payload":{"kind":"advisory","title":"vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate","summary":"vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.","evidence":"cve:CVE-2026-114051","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114051","aliases":["CVE-2026-114051"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T00:36:28.373Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-4xqp-c3mv-qff7","https://www.vulncheck.com/advisories/vllm-before-0.31.0-denial-of-service-via-min-tokens-in-inference-v1-generate"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:28.373Z"}}},"related_cves":[{"value":"CVE-2026-114051","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3e98d400-9da0-4376-a470-c5c68bfbaee6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114051","advisory_id":"3e98d400-9da0-4376-a470-c5c68bfbaee6","event_types":["advisory"],"published_at":"2026-10-25T12:25:31.427397+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:28.373+00:00","detail_url":"/events/44944"},"members":[{"id":44944,"cve_ids":["CVE-2026-114051"],"payload":{"kind":"advisory","title":"vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate","summary":"vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.","evidence":"cve:CVE-2026-114051","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114051","aliases":["CVE-2026-114051"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T00:36:28.373Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-4xqp-c3mv-qff7","https://www.vulncheck.com/advisories/vllm-before-0.31.0-denial-of-service-via-min-tokens-in-inference-v1-generate"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:28.373Z"}}},"related_cves":[{"value":"CVE-2026-114051","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3e98d400-9da0-4376-a470-c5c68bfbaee6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114051","advisory_id":"3e98d400-9da0-4376-a470-c5c68bfbaee6","event_types":["advisory"],"published_at":"2026-10-25T12:25:31.427397+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:28.373+00:00","detail_url":"/events/44944"}]}},{"id":45376,"cve_ids":["CVE-2026-114049"],"payload":{"kind":"advisory","title":"vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense","summary":"vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycled batch slots apply their token allowlist to victims' unrestricted requests.","evidence":"cve:CVE-2026-114049","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114049","aliases":["CVE-2026-114049"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T00:36:26.938Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-6cxc-2vcg-w5qc","https://www.vulncheck.com/advisories/vllm-before-0.31.0-stale-allowed-token-ids-mask-via-inputbatch-condense"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:26.938Z"}}},"related_cves":[{"value":"CVE-2026-114049","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9c6c58ec-0289-499b-9cbd-4361916de70d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114049","advisory_id":"9c6c58ec-0289-499b-9cbd-4361916de70d","event_types":["advisory"],"published_at":"2026-10-25T12:25:30.042464+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:26.938+00:00","detail_url":"/advisories/advisory%3A9c6c58ec-0289-499b-9cbd-4361916de70d","group":{"id":"advisory:9c6c58ec-0289-499b-9cbd-4361916de70d","revision":1,"primary_event_id":44942,"change":"published","superseded_by":[],"changed":{"id":44942,"cve_ids":["CVE-2026-114049"],"payload":{"kind":"advisory","title":"vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense","summary":"vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycled batch slots apply their token allowlist to victims' unrestricted requests.","evidence":"cve:CVE-2026-114049","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114049","aliases":["CVE-2026-114049"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T00:36:26.938Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-6cxc-2vcg-w5qc","https://www.vulncheck.com/advisories/vllm-before-0.31.0-stale-allowed-token-ids-mask-via-inputbatch-condense"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:26.938Z"}}},"related_cves":[{"value":"CVE-2026-114049","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9c6c58ec-0289-499b-9cbd-4361916de70d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114049","advisory_id":"9c6c58ec-0289-499b-9cbd-4361916de70d","event_types":["advisory"],"published_at":"2026-10-25T12:25:30.042464+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:26.938+00:00","detail_url":"/events/44942"},"members":[{"id":44942,"cve_ids":["CVE-2026-114049"],"payload":{"kind":"advisory","title":"vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense","summary":"vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycled batch slots apply their token allowlist to victims' unrestricted requests.","evidence":"cve:CVE-2026-114049","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114049","aliases":["CVE-2026-114049"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.31.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-21T00:36:26.938Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-6cxc-2vcg-w5qc","https://www.vulncheck.com/advisories/vllm-before-0.31.0-stale-allowed-token-ids-mask-via-inputbatch-condense"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:26.938Z"}}},"related_cves":[{"value":"CVE-2026-114049","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9c6c58ec-0289-499b-9cbd-4361916de70d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114049","advisory_id":"9c6c58ec-0289-499b-9cbd-4361916de70d","event_types":["advisory"],"published_at":"2026-10-25T12:25:30.042464+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:26.938+00:00","detail_url":"/events/44942"}]}},{"id":34956,"cve_ids":["CVE-2026-109311"],"payload":{"kind":"advisory","title":"vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload","summary":"vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process.","evidence":"cve:CVE-2026-109311","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109311","aliases":["CVE-2026-109311"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-18T11:51:50.426Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-m52c-39rh-f3gp","https://www.vulncheck.com/advisories/vllm-before-0.29.0-heap-overflow-dos-via-iamf-audio-transcription-upload"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109311","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:51:46.666911Z"}}}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-m52c-39rh-f3gp","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:51:50.426Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T16:05:06.956Z"}}},"related_cves":[{"value":"CVE-2026-109311","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bec972ed-2512-4e4c-8ffb-237d098adf6a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109311","advisory_id":"bec972ed-2512-4e4c-8ffb-237d098adf6a","event_types":["advisory"],"published_at":"2026-10-25T09:25:55.678301+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T16:05:06.956+00:00","detail_url":"/advisories/advisory%3Abec972ed-2512-4e4c-8ffb-237d098adf6a","group":{"id":"advisory:bec972ed-2512-4e4c-8ffb-237d098adf6a","revision":1,"primary_event_id":34660,"change":"published","superseded_by":[],"changed":{"id":34660,"cve_ids":["CVE-2026-109311"],"payload":{"kind":"advisory","title":"vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload","summary":"vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process.","evidence":"cve:CVE-2026-109311","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109311","aliases":["CVE-2026-109311"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-18T11:51:50.426Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-m52c-39rh-f3gp","https://www.vulncheck.com/advisories/vllm-before-0.29.0-heap-overflow-dos-via-iamf-audio-transcription-upload"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109311","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:51:46.666911Z"}}}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-m52c-39rh-f3gp","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:51:50.426Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T16:05:06.956Z"}}},"related_cves":[{"value":"CVE-2026-109311","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bec972ed-2512-4e4c-8ffb-237d098adf6a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109311","advisory_id":"bec972ed-2512-4e4c-8ffb-237d098adf6a","event_types":["advisory"],"published_at":"2026-10-25T09:25:55.678301+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T16:05:06.956+00:00","detail_url":"/events/34660"},"members":[{"id":34660,"cve_ids":["CVE-2026-109311"],"payload":{"kind":"advisory","title":"vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload","summary":"vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process.","evidence":"cve:CVE-2026-109311","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109311","aliases":["CVE-2026-109311"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-18T11:51:50.426Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-m52c-39rh-f3gp","https://www.vulncheck.com/advisories/vllm-before-0.29.0-heap-overflow-dos-via-iamf-audio-transcription-upload"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109311","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:51:46.666911Z"}}}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-m52c-39rh-f3gp","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:51:50.426Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T16:05:06.956Z"}}},"related_cves":[{"value":"CVE-2026-109311","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bec972ed-2512-4e4c-8ffb-237d098adf6a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109311","advisory_id":"bec972ed-2512-4e4c-8ffb-237d098adf6a","event_types":["advisory"],"published_at":"2026-10-25T09:25:55.678301+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T16:05:06.956+00:00","detail_url":"/events/34660"}]}},{"id":16207,"cve_ids":["CVE-2026-105775"],"payload":{"kind":"advisory","title":"vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds","summary":"A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/model_executor/layers/mamba/mamba_mixer2.py of the component Completions Request Handler. The manipulation leads to out-of-bounds read. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","evidence":"cve:CVE-2026-105775","products":[{"name":{"value":"vLLM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105775","aliases":["CVE-2026-105775"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*"],"vendor":"vllm-project","modules":["Completions Request Handler"],"product":"vLLM","versions":[{"status":"affected","version":"0.1"},{"status":"affected","version":"0.2"},{"status":"affected","version":"0.3"},{"status":"affected","version":"0.4"},{"status":"affected","version":"0.5"},{"status":"affected","version":"0.6"},{"status":"affected","version":"0.7"},{"status":"affected","version":"0.8"},{"status":"affected","version":"0.9"},{"status":"affected","version":"0.10"},{"status":"affected","version":"0.11"},{"status":"affected","version":"0.12"},{"status":"affected","version":"0.13"},{"status":"affected","version":"0.14"},{"status":"affected","version":"0.15"},{"status":"affected","version":"0.16"},{"status":"affected","version":"0.17"},{"status":"affected","version":"0.18"},{"status":"affected","version":"0.19"},{"status":"affected","version":"0.20"},{"status":"affected","version":"0.21"},{"status":"affected","version":"0.22"},{"status":"affected","version":"0.23"},{"status":"affected","version":"0.24"},{"status":"affected","version":"0.25"},{"status":"affected","version":"0.26"},{"status":"affected","version":"0.27"},{"status":"affected","version":"0.28"},{"status":"affected","version":"0.29"},{"status":"affected","version":"0.30"},{"status":"affected","version":"0.31.0"}]}],"modified":"2026-10-09T00:56:33.429Z","provider":"cve","references":["https://vuldb.com/vuln/413808","https://vuldb.com/vuln/413808/cti","https://vuldb.com/cve/CVE-2026-105775","https://vuldb.com/submit/992291","https://github.com/vllm-project/vllm/issues/57266","https://github.com/vllm-project/vllm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105775","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-09T00:56:24.861003Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-09T00:56:33.429Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-06T05:45:11.082Z"}}},"related_cves":[{"value":"CVE-2026-105775","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6b51bd89-8f8f-4ffb-bb46-921917d539a1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105775","advisory_id":"6b51bd89-8f8f-4ffb-bb46-921917d539a1","event_types":["advisory"],"published_at":"2026-10-25T01:11:04.591557+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T05:45:11.082+00:00","detail_url":"/advisories/advisory%3A6b51bd89-8f8f-4ffb-bb46-921917d539a1","group":{"id":"advisory:6b51bd89-8f8f-4ffb-bb46-921917d539a1","revision":1,"primary_event_id":16110,"change":"published","superseded_by":[],"changed":{"id":16110,"cve_ids":["CVE-2026-105775"],"payload":{"kind":"advisory","title":"vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds","summary":"A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/model_executor/layers/mamba/mamba_mixer2.py of the component Completions Request Handler. The manipulation leads to out-of-bounds read. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","evidence":"cve:CVE-2026-105775","products":[{"name":{"value":"vLLM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105775","aliases":["CVE-2026-105775"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*"],"vendor":"vllm-project","modules":["Completions Request Handler"],"product":"vLLM","versions":[{"status":"affected","version":"0.1"},{"status":"affected","version":"0.2"},{"status":"affected","version":"0.3"},{"status":"affected","version":"0.4"},{"status":"affected","version":"0.5"},{"status":"affected","version":"0.6"},{"status":"affected","version":"0.7"},{"status":"affected","version":"0.8"},{"status":"affected","version":"0.9"},{"status":"affected","version":"0.10"},{"status":"affected","version":"0.11"},{"status":"affected","version":"0.12"},{"status":"affected","version":"0.13"},{"status":"affected","version":"0.14"},{"status":"affected","version":"0.15"},{"status":"affected","version":"0.16"},{"status":"affected","version":"0.17"},{"status":"affected","version":"0.18"},{"status":"affected","version":"0.19"},{"status":"affected","version":"0.20"},{"status":"affected","version":"0.21"},{"status":"affected","version":"0.22"},{"status":"affected","version":"0.23"},{"status":"affected","version":"0.24"},{"status":"affected","version":"0.25"},{"status":"affected","version":"0.26"},{"status":"affected","version":"0.27"},{"status":"affected","version":"0.28"},{"status":"affected","version":"0.29"},{"status":"affected","version":"0.30"},{"status":"affected","version":"0.31.0"}]}],"modified":"2026-10-09T00:56:33.429Z","provider":"cve","references":["https://vuldb.com/vuln/413808","https://vuldb.com/vuln/413808/cti","https://vuldb.com/cve/CVE-2026-105775","https://vuldb.com/submit/992291","https://github.com/vllm-project/vllm/issues/57266","https://github.com/vllm-project/vllm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105775","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-09T00:56:24.861003Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-09T00:56:33.429Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-06T05:45:11.082Z"}}},"related_cves":[{"value":"CVE-2026-105775","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6b51bd89-8f8f-4ffb-bb46-921917d539a1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105775","advisory_id":"6b51bd89-8f8f-4ffb-bb46-921917d539a1","event_types":["advisory"],"published_at":"2026-10-25T01:11:04.591557+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T05:45:11.082+00:00","detail_url":"/events/16110"},"members":[{"id":16110,"cve_ids":["CVE-2026-105775"],"payload":{"kind":"advisory","title":"vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds","summary":"A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/model_executor/layers/mamba/mamba_mixer2.py of the component Completions Request Handler. The manipulation leads to out-of-bounds read. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","evidence":"cve:CVE-2026-105775","products":[{"name":{"value":"vLLM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105775","aliases":["CVE-2026-105775"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*"],"vendor":"vllm-project","modules":["Completions Request Handler"],"product":"vLLM","versions":[{"status":"affected","version":"0.1"},{"status":"affected","version":"0.2"},{"status":"affected","version":"0.3"},{"status":"affected","version":"0.4"},{"status":"affected","version":"0.5"},{"status":"affected","version":"0.6"},{"status":"affected","version":"0.7"},{"status":"affected","version":"0.8"},{"status":"affected","version":"0.9"},{"status":"affected","version":"0.10"},{"status":"affected","version":"0.11"},{"status":"affected","version":"0.12"},{"status":"affected","version":"0.13"},{"status":"affected","version":"0.14"},{"status":"affected","version":"0.15"},{"status":"affected","version":"0.16"},{"status":"affected","version":"0.17"},{"status":"affected","version":"0.18"},{"status":"affected","version":"0.19"},{"status":"affected","version":"0.20"},{"status":"affected","version":"0.21"},{"status":"affected","version":"0.22"},{"status":"affected","version":"0.23"},{"status":"affected","version":"0.24"},{"status":"affected","version":"0.25"},{"status":"affected","version":"0.26"},{"status":"affected","version":"0.27"},{"status":"affected","version":"0.28"},{"status":"affected","version":"0.29"},{"status":"affected","version":"0.30"},{"status":"affected","version":"0.31.0"}]}],"modified":"2026-10-09T00:56:33.429Z","provider":"cve","references":["https://vuldb.com/vuln/413808","https://vuldb.com/vuln/413808/cti","https://vuldb.com/cve/CVE-2026-105775","https://vuldb.com/submit/992291","https://github.com/vllm-project/vllm/issues/57266","https://github.com/vllm-project/vllm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105775","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-09T00:56:24.861003Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-09T00:56:33.429Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-06T05:45:11.082Z"}}},"related_cves":[{"value":"CVE-2026-105775","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6b51bd89-8f8f-4ffb-bb46-921917d539a1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105775","advisory_id":"6b51bd89-8f8f-4ffb-bb46-921917d539a1","event_types":["advisory"],"published_at":"2026-10-25T01:11:04.591557+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T05:45:11.082+00:00","detail_url":"/events/16110"}]}},{"id":12411,"cve_ids":["CVE-2026-105758"],"payload":{"kind":"advisory","title":"vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach","summary":"vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs.video.fps fields without enforcing server-side ceilings. An unauthenticated caller can submit these values to the /tokenize endpoint, causing the sampler to decode every frame selected from attacker-controlled video input, consume disproportionate frontend memory, and potentially terminate the API process before scheduling or admission control. The Rust frontend is not affected because it rejects the media_io_kwargs field. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105758","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105758","aliases":["CVE-2026-105758"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":">= 0.24.0, < 0.30.0"}]}],"modified":"2026-10-08T02:32:27.776Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-x6mc-67gf-chw4","https://github.com/vllm-project/vllm/pull/56729","https://github.com/vllm-project/vllm/commit/ea723c81c3ea26425cb69503a5d5e90822a04a45","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105758","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T02:32:16.874942Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T02:32:27.776Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:54:53.846Z"}}},"related_cves":[{"value":"CVE-2026-105758","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5222d2e3-d40b-4c16-bb7b-b957caa1af1b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105758","advisory_id":"5222d2e3-d40b-4c16-bb7b-b957caa1af1b","event_types":["advisory"],"published_at":"2026-10-25T00:05:47.125074+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:54:53.846+00:00","detail_url":"/advisories/advisory%3A5222d2e3-d40b-4c16-bb7b-b957caa1af1b","group":{"id":"advisory:5222d2e3-d40b-4c16-bb7b-b957caa1af1b","revision":1,"primary_event_id":12351,"change":"published","superseded_by":[],"changed":{"id":12351,"cve_ids":["CVE-2026-105758"],"payload":{"kind":"advisory","title":"vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach","summary":"vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs.video.fps fields without enforcing server-side ceilings. An unauthenticated caller can submit these values to the /tokenize endpoint, causing the sampler to decode every frame selected from attacker-controlled video input, consume disproportionate frontend memory, and potentially terminate the API process before scheduling or admission control. The Rust frontend is not affected because it rejects the media_io_kwargs field. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105758","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105758","aliases":["CVE-2026-105758"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":">= 0.24.0, < 0.30.0"}]}],"modified":"2026-10-08T02:32:27.776Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-x6mc-67gf-chw4","https://github.com/vllm-project/vllm/pull/56729","https://github.com/vllm-project/vllm/commit/ea723c81c3ea26425cb69503a5d5e90822a04a45","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105758","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T02:32:16.874942Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T02:32:27.776Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:54:53.846Z"}}},"related_cves":[{"value":"CVE-2026-105758","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5222d2e3-d40b-4c16-bb7b-b957caa1af1b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105758","advisory_id":"5222d2e3-d40b-4c16-bb7b-b957caa1af1b","event_types":["advisory"],"published_at":"2026-10-25T00:05:47.125074+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:54:53.846+00:00","detail_url":"/events/12351"},"members":[{"id":12351,"cve_ids":["CVE-2026-105758"],"payload":{"kind":"advisory","title":"vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach","summary":"vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs.video.fps fields without enforcing server-side ceilings. An unauthenticated caller can submit these values to the /tokenize endpoint, causing the sampler to decode every frame selected from attacker-controlled video input, consume disproportionate frontend memory, and potentially terminate the API process before scheduling or admission control. The Rust frontend is not affected because it rejects the media_io_kwargs field. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105758","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105758","aliases":["CVE-2026-105758"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":">= 0.24.0, < 0.30.0"}]}],"modified":"2026-10-08T02:32:27.776Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-x6mc-67gf-chw4","https://github.com/vllm-project/vllm/pull/56729","https://github.com/vllm-project/vllm/commit/ea723c81c3ea26425cb69503a5d5e90822a04a45","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105758","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T02:32:16.874942Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T02:32:27.776Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:54:53.846Z"}}},"related_cves":[{"value":"CVE-2026-105758","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5222d2e3-d40b-4c16-bb7b-b957caa1af1b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105758","advisory_id":"5222d2e3-d40b-4c16-bb7b-b957caa1af1b","event_types":["advisory"],"published_at":"2026-10-25T00:05:47.125074+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:54:53.846+00:00","detail_url":"/events/12351"}]}},{"id":12409,"cve_ids":["CVE-2026-105754"],"payload":{"kind":"advisory","title":"vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm_hashes field, ranges in the features.mm_placeholders field, and wire-selected multimodal field processors without rebinding them to the active model renderer contract. Forged grid geometry, field types, or non-positive placeholder lengths can terminate the shared EngineCore; when an attacker knows or can induce a victim's content hash, forged cache hashes can poison or retrieve cross-request encoder-cache state; and dropped sparse placeholder masks can alter replayed transport semantics. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105754","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105754","aliases":["CVE-2026-105754"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.30.0"}]}],"modified":"2026-10-08T02:31:29.137Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-ph72-cqr5-qpp7","https://github.com/vllm-project/vllm/pull/51898","https://github.com/vllm-project/vllm/commit/1970f3ed4be7fa8620e4ddc4a12c36a8384cfc27","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105754","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T02:31:20.281715Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T02:31:29.137Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:46:03.163Z"}}},"related_cves":[{"value":"CVE-2026-105754","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2ec13530-5f1f-476b-a6ad-73d92649af71","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105754","advisory_id":"2ec13530-5f1f-476b-a6ad-73d92649af71","event_types":["advisory"],"published_at":"2026-10-25T00:05:46.026774+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:46:03.163+00:00","detail_url":"/advisories/advisory%3A2ec13530-5f1f-476b-a6ad-73d92649af71","group":{"id":"advisory:2ec13530-5f1f-476b-a6ad-73d92649af71","revision":1,"primary_event_id":12349,"change":"published","superseded_by":[],"changed":{"id":12349,"cve_ids":["CVE-2026-105754"],"payload":{"kind":"advisory","title":"vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm_hashes field, ranges in the features.mm_placeholders field, and wire-selected multimodal field processors without rebinding them to the active model renderer contract. Forged grid geometry, field types, or non-positive placeholder lengths can terminate the shared EngineCore; when an attacker knows or can induce a victim's content hash, forged cache hashes can poison or retrieve cross-request encoder-cache state; and dropped sparse placeholder masks can alter replayed transport semantics. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105754","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105754","aliases":["CVE-2026-105754"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.30.0"}]}],"modified":"2026-10-08T02:31:29.137Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-ph72-cqr5-qpp7","https://github.com/vllm-project/vllm/pull/51898","https://github.com/vllm-project/vllm/commit/1970f3ed4be7fa8620e4ddc4a12c36a8384cfc27","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105754","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T02:31:20.281715Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T02:31:29.137Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:46:03.163Z"}}},"related_cves":[{"value":"CVE-2026-105754","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2ec13530-5f1f-476b-a6ad-73d92649af71","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105754","advisory_id":"2ec13530-5f1f-476b-a6ad-73d92649af71","event_types":["advisory"],"published_at":"2026-10-25T00:05:46.026774+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:46:03.163+00:00","detail_url":"/events/12349"},"members":[{"id":12349,"cve_ids":["CVE-2026-105754"],"payload":{"kind":"advisory","title":"vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm_hashes field, ranges in the features.mm_placeholders field, and wire-selected multimodal field processors without rebinding them to the active model renderer contract. Forged grid geometry, field types, or non-positive placeholder lengths can terminate the shared EngineCore; when an attacker knows or can induce a victim's content hash, forged cache hashes can poison or retrieve cross-request encoder-cache state; and dropped sparse placeholder masks can alter replayed transport semantics. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105754","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105754","aliases":["CVE-2026-105754"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.30.0"}]}],"modified":"2026-10-08T02:31:29.137Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-ph72-cqr5-qpp7","https://github.com/vllm-project/vllm/pull/51898","https://github.com/vllm-project/vllm/commit/1970f3ed4be7fa8620e4ddc4a12c36a8384cfc27","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105754","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T02:31:20.281715Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T02:31:29.137Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:46:03.163Z"}}},"related_cves":[{"value":"CVE-2026-105754","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2ec13530-5f1f-476b-a6ad-73d92649af71","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105754","advisory_id":"2ec13530-5f1f-476b-a6ad-73d92649af71","event_types":["advisory"],"published_at":"2026-10-25T00:05:46.026774+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:46:03.163+00:00","detail_url":"/events/12349"}]}},{"id":9530,"cve_ids":["CVE-2026-105759"],"payload":{"kind":"advisory","title":"vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus's Family::get_or_create function to permanently create counter and histogram label sets. Those label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105759","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105759","aliases":["CVE-2026-105759"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.30.0"}]}],"modified":"2026-10-06T17:56:44.425Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-5fj9-pfhr-6j48","https://github.com/vllm-project/vllm/pull/56058","https://github.com/vllm-project/vllm/commit/3735c2d5f5248259482b9045c34fb7a8a3892352","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105759","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T17:56:34.732350Z"}}}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-5fj9-pfhr-6j48","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T17:56:44.425Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:58:01.362Z"}}},"related_cves":[{"value":"CVE-2026-105759","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cf87f81f-c40b-408f-9568-64096f82622e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105759","advisory_id":"cf87f81f-c40b-408f-9568-64096f82622e","event_types":["advisory"],"published_at":"2026-10-24T23:18:27.02045+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:58:01.362+00:00","detail_url":"/advisories/advisory%3Acf87f81f-c40b-408f-9568-64096f82622e","group":{"id":"advisory:cf87f81f-c40b-408f-9568-64096f82622e","revision":1,"primary_event_id":9506,"change":"published","superseded_by":[],"changed":{"id":9506,"cve_ids":["CVE-2026-105759"],"payload":{"kind":"advisory","title":"vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus's Family::get_or_create function to permanently create counter and histogram label sets. Those label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105759","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105759","aliases":["CVE-2026-105759"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.30.0"}]}],"modified":"2026-10-06T17:56:44.425Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-5fj9-pfhr-6j48","https://github.com/vllm-project/vllm/pull/56058","https://github.com/vllm-project/vllm/commit/3735c2d5f5248259482b9045c34fb7a8a3892352","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105759","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T17:56:34.732350Z"}}}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-5fj9-pfhr-6j48","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T17:56:44.425Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:58:01.362Z"}}},"related_cves":[{"value":"CVE-2026-105759","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cf87f81f-c40b-408f-9568-64096f82622e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105759","advisory_id":"cf87f81f-c40b-408f-9568-64096f82622e","event_types":["advisory"],"published_at":"2026-10-24T23:18:27.02045+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:58:01.362+00:00","detail_url":"/events/9506"},"members":[{"id":9506,"cve_ids":["CVE-2026-105759"],"payload":{"kind":"advisory","title":"vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus's Family::get_or_create function to permanently create counter and histogram label sets. Those label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105759","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105759","aliases":["CVE-2026-105759"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.30.0"}]}],"modified":"2026-10-06T17:56:44.425Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-5fj9-pfhr-6j48","https://github.com/vllm-project/vllm/pull/56058","https://github.com/vllm-project/vllm/commit/3735c2d5f5248259482b9045c34fb7a8a3892352","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105759","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T17:56:34.732350Z"}}}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-5fj9-pfhr-6j48","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T17:56:44.425Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:58:01.362Z"}}},"related_cves":[{"value":"CVE-2026-105759","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cf87f81f-c40b-408f-9568-64096f82622e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105759","advisory_id":"cf87f81f-c40b-408f-9568-64096f82622e","event_types":["advisory"],"published_at":"2026-10-24T23:18:27.02045+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:58:01.362+00:00","detail_url":"/events/9506"}]}},{"id":9527,"cve_ids":["CVE-2026-105755"],"payload":{"kind":"advisory","title":"vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can overwrite the cached query embedding so the victim's documents are scored against the attacker's query, and shared use counters can also cause a late-interaction cache-miss error. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105755","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105755","aliases":["CVE-2026-105755"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.2,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 030.0"}]}],"modified":"2026-10-06T17:55:21.295Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-2phq-3phc-84px","https://github.com/vllm-project/vllm/pull/51445","https://github.com/vllm-project/vllm/commit/ee17d0d869203ef9a35ad73358a4987bba14b1fc","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105755","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T17:55:11.724369Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T17:55:21.295Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:47:54.854Z"}}},"related_cves":[{"value":"CVE-2026-105755","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b500a80d-5427-4067-b8e8-02427f89cfaa","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105755","advisory_id":"b500a80d-5427-4067-b8e8-02427f89cfaa","event_types":["advisory"],"published_at":"2026-10-24T23:18:25.31768+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:47:54.854+00:00","detail_url":"/advisories/advisory%3Ab500a80d-5427-4067-b8e8-02427f89cfaa","group":{"id":"advisory:b500a80d-5427-4067-b8e8-02427f89cfaa","revision":1,"primary_event_id":9503,"change":"published","superseded_by":[],"changed":{"id":9503,"cve_ids":["CVE-2026-105755"],"payload":{"kind":"advisory","title":"vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can overwrite the cached query embedding so the victim's documents are scored against the attacker's query, and shared use counters can also cause a late-interaction cache-miss error. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105755","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105755","aliases":["CVE-2026-105755"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.2,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 030.0"}]}],"modified":"2026-10-06T17:55:21.295Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-2phq-3phc-84px","https://github.com/vllm-project/vllm/pull/51445","https://github.com/vllm-project/vllm/commit/ee17d0d869203ef9a35ad73358a4987bba14b1fc","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105755","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T17:55:11.724369Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T17:55:21.295Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:47:54.854Z"}}},"related_cves":[{"value":"CVE-2026-105755","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b500a80d-5427-4067-b8e8-02427f89cfaa","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105755","advisory_id":"b500a80d-5427-4067-b8e8-02427f89cfaa","event_types":["advisory"],"published_at":"2026-10-24T23:18:25.31768+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:47:54.854+00:00","detail_url":"/events/9503"},"members":[{"id":9503,"cve_ids":["CVE-2026-105755"],"payload":{"kind":"advisory","title":"vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can overwrite the cached query embedding so the victim's documents are scored against the attacker's query, and shared use counters can also cause a late-interaction cache-miss error. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105755","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105755","aliases":["CVE-2026-105755"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.2,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 030.0"}]}],"modified":"2026-10-06T17:55:21.295Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-2phq-3phc-84px","https://github.com/vllm-project/vllm/pull/51445","https://github.com/vllm-project/vllm/commit/ee17d0d869203ef9a35ad73358a4987bba14b1fc","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105755","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T17:55:11.724369Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T17:55:21.295Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:47:54.854Z"}}},"related_cves":[{"value":"CVE-2026-105755","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b500a80d-5427-4067-b8e8-02427f89cfaa","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105755","advisory_id":"b500a80d-5427-4067-b8e8-02427f89cfaa","event_types":["advisory"],"published_at":"2026-10-24T23:18:25.31768+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:47:54.854+00:00","detail_url":"/events/9503"}]}},{"id":9500,"cve_ids":["CVE-2026-105922"],"payload":{"kind":"advisory","title":"vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service","summary":"A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","evidence":"cve:CVE-2026-105922","products":[{"name":{"value":"vLLM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105922","aliases":["CVE-2026-105922"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*"],"vendor":"vllm-project","modules":["Penalty Handler"],"product":"vLLM","versions":[{"status":"affected","version":"0.1"},{"status":"affected","version":"0.2"},{"status":"affected","version":"0.3"},{"status":"affected","version":"0.4"},{"status":"affected","version":"0.5"},{"status":"affected","version":"0.6"},{"status":"affected","version":"0.7"},{"status":"affected","version":"0.8"},{"status":"affected","version":"0.9"},{"status":"affected","version":"0.10"},{"status":"affected","version":"0.11"},{"status":"affected","version":"0.12"},{"status":"affected","version":"0.13"},{"status":"affected","version":"0.14"},{"status":"affected","version":"0.15"},{"status":"affected","version":"0.16"},{"status":"affected","version":"0.17"},{"status":"affected","version":"0.18"},{"status":"affected","version":"0.19"},{"status":"affected","version":"0.20"},{"status":"affected","version":"0.21"},{"status":"affected","version":"0.22"},{"status":"affected","version":"0.23"},{"status":"affected","version":"0.24"},{"status":"affected","version":"0.25"},{"status":"affected","version":"0.26"},{"status":"affected","version":"0.27"},{"status":"affected","version":"0.28"},{"status":"affected","version":"0.29"},{"status":"affected","version":"0.30"},{"status":"affected","version":"0.31.0"}]}],"modified":"2026-10-06T17:39:56.919Z","provider":"cve","references":["https://vuldb.com/vuln/413896","https://vuldb.com/vuln/413896/cti","https://vuldb.com/cve/CVE-2026-105922","https://vuldb.com/submit/992707","https://github.com/vllm-project/vllm/issues/57719","https://gist.github.com/Yunzez/5c70a3bb328eaf6d646b9d31e879dc4a#file-repro_prompt_embeds_penalties_engine_crash-py","https://github.com/vllm-project/vllm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105922","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T17:05:54.753920Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T17:39:56.919Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-06T14:45:15.075Z"}}},"related_cves":[{"value":"CVE-2026-105922","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ab950c29-0a7e-4e98-a83a-485632372f39","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105922","advisory_id":"ab950c29-0a7e-4e98-a83a-485632372f39","event_types":["advisory"],"published_at":"2026-10-24T23:18:10.178485+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T14:45:15.075+00:00","detail_url":"/advisories/advisory%3Aab950c29-0a7e-4e98-a83a-485632372f39","group":{"id":"advisory:ab950c29-0a7e-4e98-a83a-485632372f39","revision":1,"primary_event_id":9477,"change":"published","superseded_by":[],"changed":{"id":9477,"cve_ids":["CVE-2026-105922"],"payload":{"kind":"advisory","title":"vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service","summary":"A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","evidence":"cve:CVE-2026-105922","products":[{"name":{"value":"vLLM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105922","aliases":["CVE-2026-105922"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*"],"vendor":"vllm-project","modules":["Penalty Handler"],"product":"vLLM","versions":[{"status":"affected","version":"0.1"},{"status":"affected","version":"0.2"},{"status":"affected","version":"0.3"},{"status":"affected","version":"0.4"},{"status":"affected","version":"0.5"},{"status":"affected","version":"0.6"},{"status":"affected","version":"0.7"},{"status":"affected","version":"0.8"},{"status":"affected","version":"0.9"},{"status":"affected","version":"0.10"},{"status":"affected","version":"0.11"},{"status":"affected","version":"0.12"},{"status":"affected","version":"0.13"},{"status":"affected","version":"0.14"},{"status":"affected","version":"0.15"},{"status":"affected","version":"0.16"},{"status":"affected","version":"0.17"},{"status":"affected","version":"0.18"},{"status":"affected","version":"0.19"},{"status":"affected","version":"0.20"},{"status":"affected","version":"0.21"},{"status":"affected","version":"0.22"},{"status":"affected","version":"0.23"},{"status":"affected","version":"0.24"},{"status":"affected","version":"0.25"},{"status":"affected","version":"0.26"},{"status":"affected","version":"0.27"},{"status":"affected","version":"0.28"},{"status":"affected","version":"0.29"},{"status":"affected","version":"0.30"},{"status":"affected","version":"0.31.0"}]}],"modified":"2026-10-06T17:39:56.919Z","provider":"cve","references":["https://vuldb.com/vuln/413896","https://vuldb.com/vuln/413896/cti","https://vuldb.com/cve/CVE-2026-105922","https://vuldb.com/submit/992707","https://github.com/vllm-project/vllm/issues/57719","https://gist.github.com/Yunzez/5c70a3bb328eaf6d646b9d31e879dc4a#file-repro_prompt_embeds_penalties_engine_crash-py","https://github.com/vllm-project/vllm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105922","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T17:05:54.753920Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T17:39:56.919Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-06T14:45:15.075Z"}}},"related_cves":[{"value":"CVE-2026-105922","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ab950c29-0a7e-4e98-a83a-485632372f39","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105922","advisory_id":"ab950c29-0a7e-4e98-a83a-485632372f39","event_types":["advisory"],"published_at":"2026-10-24T23:18:10.178485+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T14:45:15.075+00:00","detail_url":"/events/9477"},"members":[{"id":9477,"cve_ids":["CVE-2026-105922"],"payload":{"kind":"advisory","title":"vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service","summary":"A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","evidence":"cve:CVE-2026-105922","products":[{"name":{"value":"vLLM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105922","aliases":["CVE-2026-105922"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*"],"vendor":"vllm-project","modules":["Penalty Handler"],"product":"vLLM","versions":[{"status":"affected","version":"0.1"},{"status":"affected","version":"0.2"},{"status":"affected","version":"0.3"},{"status":"affected","version":"0.4"},{"status":"affected","version":"0.5"},{"status":"affected","version":"0.6"},{"status":"affected","version":"0.7"},{"status":"affected","version":"0.8"},{"status":"affected","version":"0.9"},{"status":"affected","version":"0.10"},{"status":"affected","version":"0.11"},{"status":"affected","version":"0.12"},{"status":"affected","version":"0.13"},{"status":"affected","version":"0.14"},{"status":"affected","version":"0.15"},{"status":"affected","version":"0.16"},{"status":"affected","version":"0.17"},{"status":"affected","version":"0.18"},{"status":"affected","version":"0.19"},{"status":"affected","version":"0.20"},{"status":"affected","version":"0.21"},{"status":"affected","version":"0.22"},{"status":"affected","version":"0.23"},{"status":"affected","version":"0.24"},{"status":"affected","version":"0.25"},{"status":"affected","version":"0.26"},{"status":"affected","version":"0.27"},{"status":"affected","version":"0.28"},{"status":"affected","version":"0.29"},{"status":"affected","version":"0.30"},{"status":"affected","version":"0.31.0"}]}],"modified":"2026-10-06T17:39:56.919Z","provider":"cve","references":["https://vuldb.com/vuln/413896","https://vuldb.com/vuln/413896/cti","https://vuldb.com/cve/CVE-2026-105922","https://vuldb.com/submit/992707","https://github.com/vllm-project/vllm/issues/57719","https://gist.github.com/Yunzez/5c70a3bb328eaf6d646b9d31e879dc4a#file-repro_prompt_embeds_penalties_engine_crash-py","https://github.com/vllm-project/vllm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105922","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T17:05:54.753920Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T17:39:56.919Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-06T14:45:15.075Z"}}},"related_cves":[{"value":"CVE-2026-105922","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ab950c29-0a7e-4e98-a83a-485632372f39","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105922","advisory_id":"ab950c29-0a7e-4e98-a83a-485632372f39","event_types":["advisory"],"published_at":"2026-10-24T23:18:10.178485+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T14:45:15.075+00:00","detail_url":"/events/9477"}]}},{"id":9348,"cve_ids":["CVE-2026-105760"],"payload":{"kind":"advisory","title":"vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options without a strict work ceiling. GLMGA constructs and deduplicates an attacker-sized pre-decode frame-index list, allowing a compact request and tiny valid video to consume disproportionate CPU time and memory in the shared media-loading executor. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105760","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105760","aliases":["CVE-2026-105760"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":">= 0.23.0rc2, < 0.30.0"}]}],"modified":"2026-10-06T14:39:17.058Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-58v5-2m8f-94pr","https://github.com/vllm-project/vllm/pull/54935","https://github.com/vllm-project/vllm/commit/8b6de0eb9a09ef53f20cf06bd4d17ee264b9c2a7","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105760","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T14:38:28.658453Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T14:39:17.058Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T23:01:54.972Z"}}},"related_cves":[{"value":"CVE-2026-105760","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8c71e254-9ff4-467d-84a1-641833595007","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105760","advisory_id":"8c71e254-9ff4-467d-84a1-641833595007","event_types":["advisory"],"published_at":"2026-10-24T23:15:57.392377+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T23:01:54.972+00:00","detail_url":"/advisories/advisory%3A8c71e254-9ff4-467d-84a1-641833595007","group":{"id":"advisory:8c71e254-9ff4-467d-84a1-641833595007","revision":1,"primary_event_id":9327,"change":"published","superseded_by":[],"changed":{"id":9327,"cve_ids":["CVE-2026-105760"],"payload":{"kind":"advisory","title":"vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options without a strict work ceiling. GLMGA constructs and deduplicates an attacker-sized pre-decode frame-index list, allowing a compact request and tiny valid video to consume disproportionate CPU time and memory in the shared media-loading executor. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105760","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105760","aliases":["CVE-2026-105760"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":">= 0.23.0rc2, < 0.30.0"}]}],"modified":"2026-10-06T14:39:17.058Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-58v5-2m8f-94pr","https://github.com/vllm-project/vllm/pull/54935","https://github.com/vllm-project/vllm/commit/8b6de0eb9a09ef53f20cf06bd4d17ee264b9c2a7","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105760","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T14:38:28.658453Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T14:39:17.058Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T23:01:54.972Z"}}},"related_cves":[{"value":"CVE-2026-105760","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8c71e254-9ff4-467d-84a1-641833595007","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105760","advisory_id":"8c71e254-9ff4-467d-84a1-641833595007","event_types":["advisory"],"published_at":"2026-10-24T23:15:57.392377+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T23:01:54.972+00:00","detail_url":"/events/9327"},"members":[{"id":9327,"cve_ids":["CVE-2026-105760"],"payload":{"kind":"advisory","title":"vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options without a strict work ceiling. GLMGA constructs and deduplicates an attacker-sized pre-decode frame-index list, allowing a compact request and tiny valid video to consume disproportionate CPU time and memory in the shared media-loading executor. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105760","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105760","aliases":["CVE-2026-105760"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":">= 0.23.0rc2, < 0.30.0"}]}],"modified":"2026-10-06T14:39:17.058Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-58v5-2m8f-94pr","https://github.com/vllm-project/vllm/pull/54935","https://github.com/vllm-project/vllm/commit/8b6de0eb9a09ef53f20cf06bd4d17ee264b9c2a7","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105760","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T14:38:28.658453Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T14:39:17.058Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T23:01:54.972Z"}}},"related_cves":[{"value":"CVE-2026-105760","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8c71e254-9ff4-467d-84a1-641833595007","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105760","advisory_id":"8c71e254-9ff4-467d-84a1-641833595007","event_types":["advisory"],"published_at":"2026-10-24T23:15:57.392377+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T23:01:54.972+00:00","detail_url":"/events/9327"}]}},{"id":9347,"cve_ids":["CVE-2026-105756"],"payload":{"kind":"advisory","title":"vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105756","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105756","aliases":["CVE-2026-105756"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.30.0"}]}],"modified":"2026-10-06T14:42:13.116Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-2823-qmq8-rwvj","https://github.com/vllm-project/vllm/pull/51444","https://github.com/vllm-project/vllm/commit/e962733e08d10f7ca65dac4df99e116460b8b174","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105756","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T14:41:36.857213Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T14:42:13.116Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:49:59.642Z"}}},"related_cves":[{"value":"CVE-2026-105756","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:728ea304-82d0-4ae8-8f75-4b6b5d6d6d76","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105756","advisory_id":"728ea304-82d0-4ae8-8f75-4b6b5d6d6d76","event_types":["advisory"],"published_at":"2026-10-24T23:15:56.770436+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:49:59.642+00:00","detail_url":"/advisories/advisory%3A728ea304-82d0-4ae8-8f75-4b6b5d6d6d76","group":{"id":"advisory:728ea304-82d0-4ae8-8f75-4b6b5d6d6d76","revision":1,"primary_event_id":9326,"change":"published","superseded_by":[],"changed":{"id":9326,"cve_ids":["CVE-2026-105756"],"payload":{"kind":"advisory","title":"vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105756","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105756","aliases":["CVE-2026-105756"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.30.0"}]}],"modified":"2026-10-06T14:42:13.116Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-2823-qmq8-rwvj","https://github.com/vllm-project/vllm/pull/51444","https://github.com/vllm-project/vllm/commit/e962733e08d10f7ca65dac4df99e116460b8b174","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105756","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T14:41:36.857213Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T14:42:13.116Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:49:59.642Z"}}},"related_cves":[{"value":"CVE-2026-105756","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:728ea304-82d0-4ae8-8f75-4b6b5d6d6d76","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105756","advisory_id":"728ea304-82d0-4ae8-8f75-4b6b5d6d6d76","event_types":["advisory"],"published_at":"2026-10-24T23:15:56.770436+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:49:59.642+00:00","detail_url":"/events/9326"},"members":[{"id":9326,"cve_ids":["CVE-2026-105756"],"payload":{"kind":"advisory","title":"vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105756","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105756","aliases":["CVE-2026-105756"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.30.0"}]}],"modified":"2026-10-06T14:42:13.116Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-2823-qmq8-rwvj","https://github.com/vllm-project/vllm/pull/51444","https://github.com/vllm-project/vllm/commit/e962733e08d10f7ca65dac4df99e116460b8b174","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105756","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T14:41:36.857213Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T14:42:13.116Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:49:59.642Z"}}},"related_cves":[{"value":"CVE-2026-105756","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:728ea304-82d0-4ae8-8f75-4b6b5d6d6d76","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105756","advisory_id":"728ea304-82d0-4ae8-8f75-4b6b5d6d6d76","event_types":["advisory"],"published_at":"2026-10-24T23:15:56.770436+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:49:59.642+00:00","detail_url":"/events/9326"}]}},{"id":9346,"cve_ids":["CVE-2026-105752"],"payload":{"kind":"advisory","title":"vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through \"POST /v1/responses\" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation prefix in the global unsalted cache namespace even when the caller enabled salting. On deployments with prefix caching enabled, which is the default, an authenticated tenant who can reconstruct a victim's low-entropy post-tool history can submit the same continuation and use the cached_tokens_per_turn count to determine whether the prefix was previously processed, defeating the intended tenant isolation of salted prefix caching. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105752","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-105752","aliases":["CVE-2026-105752"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.30.0"}]}],"modified":"2026-10-06T14:48:10.692Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-935w-9g4m-p28p","https://github.com/vllm-project/vllm/pull/50195","https://github.com/vllm-project/vllm/pull/51818","https://github.com/vllm-project/vllm/commit/6a2a2bb02b563b83f946012959fd3927984d072a","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105752","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T14:34:12.970594Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T14:48:10.692Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:32:59.299Z"}}},"related_cves":[{"value":"CVE-2026-105752","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f62361c6-284e-48a6-aad7-8b331a95fa20","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105752","advisory_id":"f62361c6-284e-48a6-aad7-8b331a95fa20","event_types":["advisory"],"published_at":"2026-10-24T23:15:55.960138+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:32:59.299+00:00","detail_url":"/advisories/advisory%3Af62361c6-284e-48a6-aad7-8b331a95fa20","group":{"id":"advisory:f62361c6-284e-48a6-aad7-8b331a95fa20","revision":1,"primary_event_id":9325,"change":"published","superseded_by":[],"changed":{"id":9325,"cve_ids":["CVE-2026-105752"],"payload":{"kind":"advisory","title":"vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through \"POST /v1/responses\" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation prefix in the global unsalted cache namespace even when the caller enabled salting. On deployments with prefix caching enabled, which is the default, an authenticated tenant who can reconstruct a victim's low-entropy post-tool history can submit the same continuation and use the cached_tokens_per_turn count to determine whether the prefix was previously processed, defeating the intended tenant isolation of salted prefix caching. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105752","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-105752","aliases":["CVE-2026-105752"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.30.0"}]}],"modified":"2026-10-06T14:48:10.692Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-935w-9g4m-p28p","https://github.com/vllm-project/vllm/pull/50195","https://github.com/vllm-project/vllm/pull/51818","https://github.com/vllm-project/vllm/commit/6a2a2bb02b563b83f946012959fd3927984d072a","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105752","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T14:34:12.970594Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T14:48:10.692Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:32:59.299Z"}}},"related_cves":[{"value":"CVE-2026-105752","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f62361c6-284e-48a6-aad7-8b331a95fa20","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105752","advisory_id":"f62361c6-284e-48a6-aad7-8b331a95fa20","event_types":["advisory"],"published_at":"2026-10-24T23:15:55.960138+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:32:59.299+00:00","detail_url":"/events/9325"},"members":[{"id":9325,"cve_ids":["CVE-2026-105752"],"payload":{"kind":"advisory","title":"vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through \"POST /v1/responses\" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation prefix in the global unsalted cache namespace even when the caller enabled salting. On deployments with prefix caching enabled, which is the default, an authenticated tenant who can reconstruct a victim's low-entropy post-tool history can submit the same continuation and use the cached_tokens_per_turn count to determine whether the prefix was previously processed, defeating the intended tenant isolation of salted prefix caching. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105752","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-105752","aliases":["CVE-2026-105752"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.1,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.30.0"}]}],"modified":"2026-10-06T14:48:10.692Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-935w-9g4m-p28p","https://github.com/vllm-project/vllm/pull/50195","https://github.com/vllm-project/vllm/pull/51818","https://github.com/vllm-project/vllm/commit/6a2a2bb02b563b83f946012959fd3927984d072a","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105752","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T14:34:12.970594Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T14:48:10.692Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:32:59.299Z"}}},"related_cves":[{"value":"CVE-2026-105752","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f62361c6-284e-48a6-aad7-8b331a95fa20","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105752","advisory_id":"f62361c6-284e-48a6-aad7-8b331a95fa20","event_types":["advisory"],"published_at":"2026-10-24T23:15:55.960138+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:32:59.299+00:00","detail_url":"/events/9325"}]}},{"id":9260,"cve_ids":["CVE-2026-105757"],"payload":{"kind":"advisory","title":"vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust frontend can admit empty structured-output values that the Python frontend rejects, allowing ordinary constrained-generation requests to terminate the shared engine. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105757","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105757","aliases":["CVE-2026-105757"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.30.0"}]}],"modified":"2026-10-06T13:20:25.829Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-85xf-c7hm-whqw","https://github.com/vllm-project/vllm/pull/51450","https://github.com/vllm-project/vllm/commit/c55e15a44ec4127832d4a86928a356fdd9e68dbd","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105757","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T13:20:12.110559Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T13:20:25.829Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:52:05.000Z"}}},"related_cves":[{"value":"CVE-2026-105757","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2e771525-9551-4fe4-8ad3-4664d3dbae79","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105757","advisory_id":"2e771525-9551-4fe4-8ad3-4664d3dbae79","event_types":["advisory"],"published_at":"2026-10-24T23:14:02.397693+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:52:05+00:00","detail_url":"/advisories/advisory%3A2e771525-9551-4fe4-8ad3-4664d3dbae79","group":{"id":"advisory:2e771525-9551-4fe4-8ad3-4664d3dbae79","revision":1,"primary_event_id":9240,"change":"published","superseded_by":[],"changed":{"id":9240,"cve_ids":["CVE-2026-105757"],"payload":{"kind":"advisory","title":"vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust frontend can admit empty structured-output values that the Python frontend rejects, allowing ordinary constrained-generation requests to terminate the shared engine. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105757","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105757","aliases":["CVE-2026-105757"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.30.0"}]}],"modified":"2026-10-06T13:20:25.829Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-85xf-c7hm-whqw","https://github.com/vllm-project/vllm/pull/51450","https://github.com/vllm-project/vllm/commit/c55e15a44ec4127832d4a86928a356fdd9e68dbd","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105757","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T13:20:12.110559Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T13:20:25.829Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:52:05.000Z"}}},"related_cves":[{"value":"CVE-2026-105757","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2e771525-9551-4fe4-8ad3-4664d3dbae79","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105757","advisory_id":"2e771525-9551-4fe4-8ad3-4664d3dbae79","event_types":["advisory"],"published_at":"2026-10-24T23:14:02.397693+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:52:05+00:00","detail_url":"/events/9240"},"members":[{"id":9240,"cve_ids":["CVE-2026-105757"],"payload":{"kind":"advisory","title":"vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust frontend can admit empty structured-output values that the Python frontend rejects, allowing ordinary constrained-generation requests to terminate the shared engine. This issue is fixed in version 0.30.0.","evidence":"cve:CVE-2026-105757","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105757","aliases":["CVE-2026-105757"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.30.0"}]}],"modified":"2026-10-06T13:20:25.829Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-85xf-c7hm-whqw","https://github.com/vllm-project/vllm/pull/51450","https://github.com/vllm-project/vllm/commit/c55e15a44ec4127832d4a86928a356fdd9e68dbd","https://github.com/vllm-project/vllm/releases/tag/v0.30.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105757","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T13:20:12.110559Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T13:20:25.829Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:52:05.000Z"}}},"related_cves":[{"value":"CVE-2026-105757","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2e771525-9551-4fe4-8ad3-4664d3dbae79","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105757","advisory_id":"2e771525-9551-4fe4-8ad3-4664d3dbae79","event_types":["advisory"],"published_at":"2026-10-24T23:14:02.397693+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:52:05+00:00","detail_url":"/events/9240"}]}},{"id":9259,"cve_ids":["CVE-2026-105753"],"payload":{"kind":"advisory","title":"vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if that request is rejected. A later request reusing the same media hash causes MultiModalProcessorSenderCache to send no payload and MultiModalReceiverCache to reach an assertion with the message \"Expected a cached item,\" producing a shared-service availability failure. This issue is fixed in version 0.28.0.","evidence":"cve:CVE-2026-105753","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105753","aliases":["CVE-2026-105753"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.28.0"}]}],"modified":"2026-10-06T13:23:03.982Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-ph3r-5jfg-f84f","https://github.com/vllm-project/vllm/pull/46747","https://github.com/vllm-project/vllm/pull/51897","https://github.com/vllm-project/vllm/commit/396204230423b7cc6798300926b8fa30190d26a9","https://github.com/vllm-project/vllm/releases/tag/v0.28.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105753","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T13:21:53.802331Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T13:23:03.982Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:37:19.633Z"}}},"related_cves":[{"value":"CVE-2026-105753","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e115238e-0dc6-4b6d-901c-e5741dd2aa87","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105753","advisory_id":"e115238e-0dc6-4b6d-901c-e5741dd2aa87","event_types":["advisory"],"published_at":"2026-10-24T23:14:01.818964+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:37:19.633+00:00","detail_url":"/advisories/advisory%3Ae115238e-0dc6-4b6d-901c-e5741dd2aa87","group":{"id":"advisory:e115238e-0dc6-4b6d-901c-e5741dd2aa87","revision":1,"primary_event_id":9239,"change":"published","superseded_by":[],"changed":{"id":9239,"cve_ids":["CVE-2026-105753"],"payload":{"kind":"advisory","title":"vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if that request is rejected. A later request reusing the same media hash causes MultiModalProcessorSenderCache to send no payload and MultiModalReceiverCache to reach an assertion with the message \"Expected a cached item,\" producing a shared-service availability failure. This issue is fixed in version 0.28.0.","evidence":"cve:CVE-2026-105753","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105753","aliases":["CVE-2026-105753"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.28.0"}]}],"modified":"2026-10-06T13:23:03.982Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-ph3r-5jfg-f84f","https://github.com/vllm-project/vllm/pull/46747","https://github.com/vllm-project/vllm/pull/51897","https://github.com/vllm-project/vllm/commit/396204230423b7cc6798300926b8fa30190d26a9","https://github.com/vllm-project/vllm/releases/tag/v0.28.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105753","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T13:21:53.802331Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T13:23:03.982Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:37:19.633Z"}}},"related_cves":[{"value":"CVE-2026-105753","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e115238e-0dc6-4b6d-901c-e5741dd2aa87","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105753","advisory_id":"e115238e-0dc6-4b6d-901c-e5741dd2aa87","event_types":["advisory"],"published_at":"2026-10-24T23:14:01.818964+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:37:19.633+00:00","detail_url":"/events/9239"},"members":[{"id":9239,"cve_ids":["CVE-2026-105753"],"payload":{"kind":"advisory","title":"vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if that request is rejected. A later request reusing the same media hash causes MultiModalProcessorSenderCache to send no payload and MultiModalReceiverCache to reach an assertion with the message \"Expected a cached item,\" producing a shared-service availability failure. This issue is fixed in version 0.28.0.","evidence":"cve:CVE-2026-105753","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105753","aliases":["CVE-2026-105753"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"< 0.28.0"}]}],"modified":"2026-10-06T13:23:03.982Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-ph3r-5jfg-f84f","https://github.com/vllm-project/vllm/pull/46747","https://github.com/vllm-project/vllm/pull/51897","https://github.com/vllm-project/vllm/commit/396204230423b7cc6798300926b8fa30190d26a9","https://github.com/vllm-project/vllm/releases/tag/v0.28.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105753","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T13:21:53.802331Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T13:23:03.982Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-05T22:37:19.633Z"}}},"related_cves":[{"value":"CVE-2026-105753","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e115238e-0dc6-4b6d-901c-e5741dd2aa87","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105753","advisory_id":"e115238e-0dc6-4b6d-901c-e5741dd2aa87","event_types":["advisory"],"published_at":"2026-10-24T23:14:01.818964+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T22:37:19.633+00:00","detail_url":"/events/9239"}]}},{"id":8109,"cve_ids":["CVE-2026-100649"],"payload":{"kind":"advisory","title":"vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass","summary":"vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits and exhaust unaccounted GPU memory.","evidence":"cve:CVE-2026-100649","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100649","aliases":["CVE-2026-100649"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-02T18:00:11.135Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-j682-9xp5-rrf3","https://www.vulncheck.com/advisories/vllm-before-0.29.0-resource-limit-bypass-via-sampler-subclass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100649","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-02T18:00:00.754862Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T18:00:11.135Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:19.687Z"}}},"related_cves":[{"value":"CVE-2026-100649","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:64dc4f12-fc27-49ed-a8b2-cb43f2042cd8","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100649","advisory_id":"64dc4f12-fc27-49ed-a8b2-cb43f2042cd8","event_types":["advisory"],"published_at":"2026-10-24T22:55:22.127324+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:19.687+00:00","detail_url":"/advisories/advisory%3A64dc4f12-fc27-49ed-a8b2-cb43f2042cd8","group":{"id":"advisory:64dc4f12-fc27-49ed-a8b2-cb43f2042cd8","revision":1,"primary_event_id":8104,"change":"published","superseded_by":[],"changed":{"id":8104,"cve_ids":["CVE-2026-100649"],"payload":{"kind":"advisory","title":"vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass","summary":"vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits and exhaust unaccounted GPU memory.","evidence":"cve:CVE-2026-100649","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100649","aliases":["CVE-2026-100649"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-02T18:00:11.135Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-j682-9xp5-rrf3","https://www.vulncheck.com/advisories/vllm-before-0.29.0-resource-limit-bypass-via-sampler-subclass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100649","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-02T18:00:00.754862Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T18:00:11.135Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:19.687Z"}}},"related_cves":[{"value":"CVE-2026-100649","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:64dc4f12-fc27-49ed-a8b2-cb43f2042cd8","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100649","advisory_id":"64dc4f12-fc27-49ed-a8b2-cb43f2042cd8","event_types":["advisory"],"published_at":"2026-10-24T22:55:22.127324+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:19.687+00:00","detail_url":"/events/8104"},"members":[{"id":8104,"cve_ids":["CVE-2026-100649"],"payload":{"kind":"advisory","title":"vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass","summary":"vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits and exhaust unaccounted GPU memory.","evidence":"cve:CVE-2026-100649","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100649","aliases":["CVE-2026-100649"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-02T18:00:11.135Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-j682-9xp5-rrf3","https://www.vulncheck.com/advisories/vllm-before-0.29.0-resource-limit-bypass-via-sampler-subclass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100649","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-02T18:00:00.754862Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T18:00:11.135Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:19.687Z"}}},"related_cves":[{"value":"CVE-2026-100649","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:64dc4f12-fc27-49ed-a8b2-cb43f2042cd8","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100649","advisory_id":"64dc4f12-fc27-49ed-a8b2-cb43f2042cd8","event_types":["advisory"],"published_at":"2026-10-24T22:55:22.127324+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:19.687+00:00","detail_url":"/events/8104"}]}},{"id":8021,"cve_ids":["CVE-2026-103241"],"payload":{"kind":"advisory","title":"vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service","summary":"A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 0.29.1rc0 is able to resolve this issue. This patch is called 3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9. Upgrading the affected component is advised.","evidence":"cve:CVE-2026-103241","products":[{"name":{"value":"vLLM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-103241","aliases":["CVE-2026-103241"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*"],"vendor":"vllm-project","modules":["Gemma4UnifiedParser"],"product":"vLLM","versions":[{"status":"affected","version":"0.1"},{"status":"affected","version":"0.2"},{"status":"affected","version":"0.3"},{"status":"affected","version":"0.4"},{"status":"affected","version":"0.5"},{"status":"affected","version":"0.6"},{"status":"affected","version":"0.7"},{"status":"affected","version":"0.8"},{"status":"affected","version":"0.9"},{"status":"affected","version":"0.10"},{"status":"affected","version":"0.11"},{"status":"affected","version":"0.12"},{"status":"affected","version":"0.13"},{"status":"affected","version":"0.14"},{"status":"affected","version":"0.15"},{"status":"affected","version":"0.16"},{"status":"affected","version":"0.17"},{"status":"affected","version":"0.18"},{"status":"affected","version":"0.19"},{"status":"affected","version":"0.20"},{"status":"affected","version":"0.21"},{"status":"affected","version":"0.22"},{"status":"affected","version":"0.23"},{"status":"affected","version":"0.24"},{"status":"affected","version":"0.25"},{"status":"affected","version":"0.26.0"},{"status":"unaffected","version":"0.29.1rc0"}]}],"modified":"2026-10-02T16:23:50.737Z","provider":"cve","references":["https://vuldb.com/vuln/411965","https://vuldb.com/vuln/411965/cti","https://vuldb.com/cve/CVE-2026-103241","https://vuldb.com/submit/956250","https://github.com/vllm-project/vllm/issues/50927","https://github.com/vllm-project/vllm/pull/54303","https://gist.github.com/Yunzez/8e98d656aa667095b513161eb056d28e","https://github.com/vllm-project/vllm/commit/3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9","https://github.com/vllm-project/vllm/releases/tag/v0.29.1rc0","https://github.com/vllm-project/vllm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-103241","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-02T16:23:38.542254Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T16:23:50.737Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-30T16:45:13.581Z"}}},"related_cves":[{"value":"CVE-2026-103241","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d2620dce-c55d-46ec-9d9b-bcc5b719850f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103241","advisory_id":"d2620dce-c55d-46ec-9d9b-bcc5b719850f","event_types":["advisory"],"published_at":"2026-10-24T22:54:21.959339+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T16:45:13.581+00:00","detail_url":"/advisories/advisory%3Ad2620dce-c55d-46ec-9d9b-bcc5b719850f","group":{"id":"advisory:d2620dce-c55d-46ec-9d9b-bcc5b719850f","revision":1,"primary_event_id":8017,"change":"published","superseded_by":[],"changed":{"id":8017,"cve_ids":["CVE-2026-103241"],"payload":{"kind":"advisory","title":"vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service","summary":"A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 0.29.1rc0 is able to resolve this issue. This patch is called 3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9. Upgrading the affected component is advised.","evidence":"cve:CVE-2026-103241","products":[{"name":{"value":"vLLM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-103241","aliases":["CVE-2026-103241"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*"],"vendor":"vllm-project","modules":["Gemma4UnifiedParser"],"product":"vLLM","versions":[{"status":"affected","version":"0.1"},{"status":"affected","version":"0.2"},{"status":"affected","version":"0.3"},{"status":"affected","version":"0.4"},{"status":"affected","version":"0.5"},{"status":"affected","version":"0.6"},{"status":"affected","version":"0.7"},{"status":"affected","version":"0.8"},{"status":"affected","version":"0.9"},{"status":"affected","version":"0.10"},{"status":"affected","version":"0.11"},{"status":"affected","version":"0.12"},{"status":"affected","version":"0.13"},{"status":"affected","version":"0.14"},{"status":"affected","version":"0.15"},{"status":"affected","version":"0.16"},{"status":"affected","version":"0.17"},{"status":"affected","version":"0.18"},{"status":"affected","version":"0.19"},{"status":"affected","version":"0.20"},{"status":"affected","version":"0.21"},{"status":"affected","version":"0.22"},{"status":"affected","version":"0.23"},{"status":"affected","version":"0.24"},{"status":"affected","version":"0.25"},{"status":"affected","version":"0.26.0"},{"status":"unaffected","version":"0.29.1rc0"}]}],"modified":"2026-10-02T16:23:50.737Z","provider":"cve","references":["https://vuldb.com/vuln/411965","https://vuldb.com/vuln/411965/cti","https://vuldb.com/cve/CVE-2026-103241","https://vuldb.com/submit/956250","https://github.com/vllm-project/vllm/issues/50927","https://github.com/vllm-project/vllm/pull/54303","https://gist.github.com/Yunzez/8e98d656aa667095b513161eb056d28e","https://github.com/vllm-project/vllm/commit/3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9","https://github.com/vllm-project/vllm/releases/tag/v0.29.1rc0","https://github.com/vllm-project/vllm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-103241","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-02T16:23:38.542254Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T16:23:50.737Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-30T16:45:13.581Z"}}},"related_cves":[{"value":"CVE-2026-103241","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d2620dce-c55d-46ec-9d9b-bcc5b719850f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103241","advisory_id":"d2620dce-c55d-46ec-9d9b-bcc5b719850f","event_types":["advisory"],"published_at":"2026-10-24T22:54:21.959339+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T16:45:13.581+00:00","detail_url":"/events/8017"},"members":[{"id":8017,"cve_ids":["CVE-2026-103241"],"payload":{"kind":"advisory","title":"vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service","summary":"A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 0.29.1rc0 is able to resolve this issue. This patch is called 3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9. Upgrading the affected component is advised.","evidence":"cve:CVE-2026-103241","products":[{"name":{"value":"vLLM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-103241","aliases":["CVE-2026-103241"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*"],"vendor":"vllm-project","modules":["Gemma4UnifiedParser"],"product":"vLLM","versions":[{"status":"affected","version":"0.1"},{"status":"affected","version":"0.2"},{"status":"affected","version":"0.3"},{"status":"affected","version":"0.4"},{"status":"affected","version":"0.5"},{"status":"affected","version":"0.6"},{"status":"affected","version":"0.7"},{"status":"affected","version":"0.8"},{"status":"affected","version":"0.9"},{"status":"affected","version":"0.10"},{"status":"affected","version":"0.11"},{"status":"affected","version":"0.12"},{"status":"affected","version":"0.13"},{"status":"affected","version":"0.14"},{"status":"affected","version":"0.15"},{"status":"affected","version":"0.16"},{"status":"affected","version":"0.17"},{"status":"affected","version":"0.18"},{"status":"affected","version":"0.19"},{"status":"affected","version":"0.20"},{"status":"affected","version":"0.21"},{"status":"affected","version":"0.22"},{"status":"affected","version":"0.23"},{"status":"affected","version":"0.24"},{"status":"affected","version":"0.25"},{"status":"affected","version":"0.26.0"},{"status":"unaffected","version":"0.29.1rc0"}]}],"modified":"2026-10-02T16:23:50.737Z","provider":"cve","references":["https://vuldb.com/vuln/411965","https://vuldb.com/vuln/411965/cti","https://vuldb.com/cve/CVE-2026-103241","https://vuldb.com/submit/956250","https://github.com/vllm-project/vllm/issues/50927","https://github.com/vllm-project/vllm/pull/54303","https://gist.github.com/Yunzez/8e98d656aa667095b513161eb056d28e","https://github.com/vllm-project/vllm/commit/3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9","https://github.com/vllm-project/vllm/releases/tag/v0.29.1rc0","https://github.com/vllm-project/vllm/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-103241","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-02T16:23:38.542254Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T16:23:50.737Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-30T16:45:13.581Z"}}},"related_cves":[{"value":"CVE-2026-103241","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d2620dce-c55d-46ec-9d9b-bcc5b719850f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103241","advisory_id":"d2620dce-c55d-46ec-9d9b-bcc5b719850f","event_types":["advisory"],"published_at":"2026-10-24T22:54:21.959339+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T16:45:13.581+00:00","detail_url":"/events/8017"}]}},{"id":5078,"cve_ids":["CVE-2026-100653"],"payload":{"kind":"advisory","title":"vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation","summary":"vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast loads in vllm/model_executor/models/funaudiochat.py and the Qwen2VLConfig.from_pretrained call used by Tarsier2ProcessingInfo in vllm/model_executor/models/qwen2_vl.py. As a result, deployments pinned to a reviewed revision still resolve these behavior-affecting processor, tokenizer, and config artifacts from the repository's default revision, so a later change to the upstream default branch can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. This is a supply-chain integrity and reproducibility failure for pinned deployments; it is residual to the earlier fix tracked as GHSA-3ww4-5jv9-j5gm / CVE-2026-47155 and does not constitute remote code execution or a trust_remote_code=False bypass. The issue is fixed in version 0.28.0.","evidence":"cve:CVE-2026-100653","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100653","aliases":["CVE-2026-100653"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0.22.1","lessThan":"0.28.0","versionType":"semver"},{"status":"unaffected","version":"0.28.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-01T11:06:45.139Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-hhv2-872h-628q","https://github.com/vllm-project/vllm/commit/d26a28ab033697f55a1414b5b0435de7cd6045b6","https://www.vulncheck.com/advisories/vllm-0.22.1-before-0.28.0-incomplete-artifact-pin-propagation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100653","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T17:46:29.258369Z"}}}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-hhv2-872h-628q","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T17:46:36.993Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T11:06:45.139Z"}}},"related_cves":[{"value":"CVE-2026-100653","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d6bde8ff-c215-4fef-b0ba-0b733d6396ff","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100653","advisory_id":"d6bde8ff-c215-4fef-b0ba-0b733d6396ff","event_types":["advisory"],"published_at":"2026-10-24T22:03:01.795214+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:22.605+00:00","detail_url":"/advisories/advisory%3Ad6bde8ff-c215-4fef-b0ba-0b733d6396ff","group":{"id":"advisory:d6bde8ff-c215-4fef-b0ba-0b733d6396ff","revision":1,"primary_event_id":5102,"change":"published","superseded_by":[],"changed":{"id":5102,"cve_ids":["CVE-2026-100653"],"payload":{"kind":"advisory","title":"vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation","summary":"vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast loads in vllm/model_executor/models/funaudiochat.py and the Qwen2VLConfig.from_pretrained call used by Tarsier2ProcessingInfo in vllm/model_executor/models/qwen2_vl.py. As a result, deployments pinned to a reviewed revision still resolve these behavior-affecting processor, tokenizer, and config artifacts from the repository's default revision, so a later change to the upstream default branch can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. This is a supply-chain integrity and reproducibility failure for pinned deployments; it is residual to the earlier fix tracked as GHSA-3ww4-5jv9-j5gm / CVE-2026-47155 and does not constitute remote code execution or a trust_remote_code=False bypass. The issue is fixed in version 0.28.0.","evidence":"cve:CVE-2026-100653","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100653","aliases":["CVE-2026-100653"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0.22.1","lessThan":"0.28.0","versionType":"semver"},{"status":"unaffected","version":"0.28.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-01T11:06:45.139Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-hhv2-872h-628q","https://github.com/vllm-project/vllm/commit/d26a28ab033697f55a1414b5b0435de7cd6045b6","https://www.vulncheck.com/advisories/vllm-0.22.1-before-0.28.0-incomplete-artifact-pin-propagation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100653","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T17:46:29.258369Z"}}}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-hhv2-872h-628q","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T17:46:36.993Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T11:06:45.139Z"}}},"related_cves":[{"value":"CVE-2026-100653","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d6bde8ff-c215-4fef-b0ba-0b733d6396ff","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100653","advisory_id":"d6bde8ff-c215-4fef-b0ba-0b733d6396ff","event_types":["advisory"],"published_at":"2026-10-24T22:03:01.795214+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:22.605+00:00","detail_url":"/events/5102"},"members":[{"id":5102,"cve_ids":["CVE-2026-100653"],"payload":{"kind":"advisory","title":"vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation","summary":"vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast loads in vllm/model_executor/models/funaudiochat.py and the Qwen2VLConfig.from_pretrained call used by Tarsier2ProcessingInfo in vllm/model_executor/models/qwen2_vl.py. As a result, deployments pinned to a reviewed revision still resolve these behavior-affecting processor, tokenizer, and config artifacts from the repository's default revision, so a later change to the upstream default branch can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. This is a supply-chain integrity and reproducibility failure for pinned deployments; it is residual to the earlier fix tracked as GHSA-3ww4-5jv9-j5gm / CVE-2026-47155 and does not constitute remote code execution or a trust_remote_code=False bypass. The issue is fixed in version 0.28.0.","evidence":"cve:CVE-2026-100653","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100653","aliases":["CVE-2026-100653"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0.22.1","lessThan":"0.28.0","versionType":"semver"},{"status":"unaffected","version":"0.28.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-01T11:06:45.139Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-hhv2-872h-628q","https://github.com/vllm-project/vllm/commit/d26a28ab033697f55a1414b5b0435de7cd6045b6","https://www.vulncheck.com/advisories/vllm-0.22.1-before-0.28.0-incomplete-artifact-pin-propagation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100653","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T17:46:29.258369Z"}}}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-hhv2-872h-628q","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T17:46:36.993Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T11:06:45.139Z"}}},"related_cves":[{"value":"CVE-2026-100653","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d6bde8ff-c215-4fef-b0ba-0b733d6396ff","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100653","advisory_id":"d6bde8ff-c215-4fef-b0ba-0b733d6396ff","event_types":["advisory"],"published_at":"2026-10-24T22:03:01.795214+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:22.605+00:00","detail_url":"/events/5102"}]}},{"id":5075,"cve_ids":["CVE-2026-100650"],"payload":{"kind":"advisory","title":"vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization","summary":"vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits). Across four ingress paths — the shared media-acquisition layer (HTTPConnection.get_bytes()/async_get_bytes()), the chat completions audio_url/base64 path, the batch speech runner, and the Rust frontend POST /tokenize route — the server reads the entire HTTP response body, base64-decodes the inline payload, or spawns one fetch/decode task per media part, and only then applies the limit (or, on some paths, never applies it). A remote attacker can therefore cause the API server or batch-runner process to allocate memory and consume outbound bandwidth proportional to an attacker-chosen body size or media item count before the request is rejected, resulting in pre-inference memory and bandwidth exhaustion (denial of service). The chat and batch surfaces require an API key when one is configured; the Rust frontend /tokenize route is unauthenticated by design. There is no code execution or data disclosure impact.","evidence":"cve:CVE-2026-100650","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100650","aliases":["CVE-2026-100650"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-01T11:06:44.741Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-p6g9-7v3x-m8mv","https://github.com/vllm-project/vllm/commit/752a3a504485790a2e8491cacbb35c137339ad34","https://www.vulncheck.com/advisories/vllm-before-0.29.0-resource-exhaustion-via-unbounded-media-materialization"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100650","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T14:49:40.322864Z"}}}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-p6g9-7v3x-m8mv","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T14:50:14.406Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T11:06:44.741Z"}}},"related_cves":[{"value":"CVE-2026-100650","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1787b8c7-c4c4-4012-aa47-516ceabd039e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100650","advisory_id":"1787b8c7-c4c4-4012-aa47-516ceabd039e","event_types":["advisory"],"published_at":"2026-10-24T22:02:59.658311+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:20.418+00:00","detail_url":"/advisories/advisory%3A1787b8c7-c4c4-4012-aa47-516ceabd039e","group":{"id":"advisory:1787b8c7-c4c4-4012-aa47-516ceabd039e","revision":1,"primary_event_id":5099,"change":"published","superseded_by":[],"changed":{"id":5099,"cve_ids":["CVE-2026-100650"],"payload":{"kind":"advisory","title":"vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization","summary":"vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits). Across four ingress paths — the shared media-acquisition layer (HTTPConnection.get_bytes()/async_get_bytes()), the chat completions audio_url/base64 path, the batch speech runner, and the Rust frontend POST /tokenize route — the server reads the entire HTTP response body, base64-decodes the inline payload, or spawns one fetch/decode task per media part, and only then applies the limit (or, on some paths, never applies it). A remote attacker can therefore cause the API server or batch-runner process to allocate memory and consume outbound bandwidth proportional to an attacker-chosen body size or media item count before the request is rejected, resulting in pre-inference memory and bandwidth exhaustion (denial of service). The chat and batch surfaces require an API key when one is configured; the Rust frontend /tokenize route is unauthenticated by design. There is no code execution or data disclosure impact.","evidence":"cve:CVE-2026-100650","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100650","aliases":["CVE-2026-100650"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-01T11:06:44.741Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-p6g9-7v3x-m8mv","https://github.com/vllm-project/vllm/commit/752a3a504485790a2e8491cacbb35c137339ad34","https://www.vulncheck.com/advisories/vllm-before-0.29.0-resource-exhaustion-via-unbounded-media-materialization"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100650","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T14:49:40.322864Z"}}}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-p6g9-7v3x-m8mv","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T14:50:14.406Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T11:06:44.741Z"}}},"related_cves":[{"value":"CVE-2026-100650","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1787b8c7-c4c4-4012-aa47-516ceabd039e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100650","advisory_id":"1787b8c7-c4c4-4012-aa47-516ceabd039e","event_types":["advisory"],"published_at":"2026-10-24T22:02:59.658311+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:20.418+00:00","detail_url":"/events/5099"},"members":[{"id":5099,"cve_ids":["CVE-2026-100650"],"payload":{"kind":"advisory","title":"vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization","summary":"vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits). Across four ingress paths — the shared media-acquisition layer (HTTPConnection.get_bytes()/async_get_bytes()), the chat completions audio_url/base64 path, the batch speech runner, and the Rust frontend POST /tokenize route — the server reads the entire HTTP response body, base64-decodes the inline payload, or spawns one fetch/decode task per media part, and only then applies the limit (or, on some paths, never applies it). A remote attacker can therefore cause the API server or batch-runner process to allocate memory and consume outbound bandwidth proportional to an attacker-chosen body size or media item count before the request is rejected, resulting in pre-inference memory and bandwidth exhaustion (denial of service). The chat and batch surfaces require an API key when one is configured; the Rust frontend /tokenize route is unauthenticated by design. There is no code execution or data disclosure impact.","evidence":"cve:CVE-2026-100650","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100650","aliases":["CVE-2026-100650"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-10-01T11:06:44.741Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-p6g9-7v3x-m8mv","https://github.com/vllm-project/vllm/commit/752a3a504485790a2e8491cacbb35c137339ad34","https://www.vulncheck.com/advisories/vllm-before-0.29.0-resource-exhaustion-via-unbounded-media-materialization"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100650","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T14:49:40.322864Z"}}}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-p6g9-7v3x-m8mv","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T14:50:14.406Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T11:06:44.741Z"}}},"related_cves":[{"value":"CVE-2026-100650","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1787b8c7-c4c4-4012-aa47-516ceabd039e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100650","advisory_id":"1787b8c7-c4c4-4012-aa47-516ceabd039e","event_types":["advisory"],"published_at":"2026-10-24T22:02:59.658311+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:20.418+00:00","detail_url":"/events/5099"}]}},{"id":4417,"cve_ids":["CVE-2026-100654"],"payload":{"kind":"advisory","title":"vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids","summary":"vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When min_tokens > 0, the stop token ids are used as logits indices to suppress stop tokens, so an out-of-range id reaches a CUDA indexing operation (index_put_) and triggers a device-side assertion. An authenticated API user can send a single malformed completion request that returns 500 Internal Server Error and puts EngineCore into a fatal state, causing subsequent requests to fail until the service is restarted (denial of service).","evidence":"cve:CVE-2026-100654","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100654","aliases":["CVE-2026-100654"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-30T14:51:39.132Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-v5gm-qgmv-gc6c","https://www.vulncheck.com/advisories/vllm-before-0.29.0-denial-of-service-via-out-of-range-stop-token-ids"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100654","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T14:51:29.949766Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T14:51:39.132Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:23.312Z"}}},"related_cves":[{"value":"CVE-2026-100654","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7c535937-30fe-4c3f-8011-e532ba447fdd","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100654","advisory_id":"7c535937-30fe-4c3f-8011-e532ba447fdd","event_types":["advisory"],"published_at":"2026-10-24T21:51:28.719285+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:23.312+00:00","detail_url":"/advisories/advisory%3A7c535937-30fe-4c3f-8011-e532ba447fdd","group":{"id":"advisory:7c535937-30fe-4c3f-8011-e532ba447fdd","revision":1,"primary_event_id":4433,"change":"published","superseded_by":[],"changed":{"id":4433,"cve_ids":["CVE-2026-100654"],"payload":{"kind":"advisory","title":"vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids","summary":"vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When min_tokens > 0, the stop token ids are used as logits indices to suppress stop tokens, so an out-of-range id reaches a CUDA indexing operation (index_put_) and triggers a device-side assertion. An authenticated API user can send a single malformed completion request that returns 500 Internal Server Error and puts EngineCore into a fatal state, causing subsequent requests to fail until the service is restarted (denial of service).","evidence":"cve:CVE-2026-100654","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100654","aliases":["CVE-2026-100654"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-30T14:51:39.132Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-v5gm-qgmv-gc6c","https://www.vulncheck.com/advisories/vllm-before-0.29.0-denial-of-service-via-out-of-range-stop-token-ids"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100654","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T14:51:29.949766Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T14:51:39.132Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:23.312Z"}}},"related_cves":[{"value":"CVE-2026-100654","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7c535937-30fe-4c3f-8011-e532ba447fdd","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100654","advisory_id":"7c535937-30fe-4c3f-8011-e532ba447fdd","event_types":["advisory"],"published_at":"2026-10-24T21:51:28.719285+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:23.312+00:00","detail_url":"/events/4433"},"members":[{"id":4433,"cve_ids":["CVE-2026-100654"],"payload":{"kind":"advisory","title":"vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids","summary":"vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When min_tokens > 0, the stop token ids are used as logits indices to suppress stop tokens, so an out-of-range id reaches a CUDA indexing operation (index_put_) and triggers a device-side assertion. An authenticated API user can send a single malformed completion request that returns 500 Internal Server Error and puts EngineCore into a fatal state, causing subsequent requests to fail until the service is restarted (denial of service).","evidence":"cve:CVE-2026-100654","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100654","aliases":["CVE-2026-100654"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-30T14:51:39.132Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-v5gm-qgmv-gc6c","https://www.vulncheck.com/advisories/vllm-before-0.29.0-denial-of-service-via-out-of-range-stop-token-ids"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100654","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T14:51:29.949766Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T14:51:39.132Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:23.312Z"}}},"related_cves":[{"value":"CVE-2026-100654","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7c535937-30fe-4c3f-8011-e532ba447fdd","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100654","advisory_id":"7c535937-30fe-4c3f-8011-e532ba447fdd","event_types":["advisory"],"published_at":"2026-10-24T21:51:28.719285+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:23.312+00:00","detail_url":"/events/4433"}]}},{"id":3278,"cve_ids":["CVE-2026-100651"],"payload":{"kind":"advisory","title":"vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass","summary":"vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' (multimodal) payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal EngineInput directly from the caller-supplied token_ids, and GenerateRequest.token_ids (vllm/entrypoints/serve/disagg/protocol.py) is not checked against model_config.max_model_len. For multimodal processors that report skip_prompt_length_check=True (for example Nemotron Parse, Whisper, and FireRedLID), InputProcessor._validate_prompt_len() returns immediately for both encoder and decoder prompts, so an overlong prompt becomes an EngineCoreRequest and reaches the worker input-batch copy into a fixed max_model_len-wide NumPy row. A client able to reach the endpoint on an affected model configuration can therefore submit an overlong token_ids list to trigger a worker failure and denial of service. Fixed in 0.29.0.","evidence":"cve:CVE-2026-100651","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100651","aliases":["CVE-2026-100651"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-28T18:25:40.222Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-3mqx-f33v-vgp9","https://www.vulncheck.com/advisories/vllm-before-0.29.0-denial-of-service-via-decoder-prompt-length-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100651","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T18:21:26.899493Z"}}}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-3mqx-f33v-vgp9","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:25:40.222Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:21.141Z"}}},"related_cves":[{"value":"CVE-2026-100651","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:18aefbda-f8dc-4aef-b15d-e958b98a7550","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100651","advisory_id":"18aefbda-f8dc-4aef-b15d-e958b98a7550","event_types":["advisory"],"published_at":"2026-10-24T21:32:12.696145+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:21.141+00:00","detail_url":"/advisories/advisory%3A18aefbda-f8dc-4aef-b15d-e958b98a7550","group":{"id":"advisory:18aefbda-f8dc-4aef-b15d-e958b98a7550","revision":1,"primary_event_id":3290,"change":"published","superseded_by":[],"changed":{"id":3290,"cve_ids":["CVE-2026-100651"],"payload":{"kind":"advisory","title":"vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass","summary":"vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' (multimodal) payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal EngineInput directly from the caller-supplied token_ids, and GenerateRequest.token_ids (vllm/entrypoints/serve/disagg/protocol.py) is not checked against model_config.max_model_len. For multimodal processors that report skip_prompt_length_check=True (for example Nemotron Parse, Whisper, and FireRedLID), InputProcessor._validate_prompt_len() returns immediately for both encoder and decoder prompts, so an overlong prompt becomes an EngineCoreRequest and reaches the worker input-batch copy into a fixed max_model_len-wide NumPy row. A client able to reach the endpoint on an affected model configuration can therefore submit an overlong token_ids list to trigger a worker failure and denial of service. Fixed in 0.29.0.","evidence":"cve:CVE-2026-100651","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100651","aliases":["CVE-2026-100651"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-28T18:25:40.222Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-3mqx-f33v-vgp9","https://www.vulncheck.com/advisories/vllm-before-0.29.0-denial-of-service-via-decoder-prompt-length-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100651","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T18:21:26.899493Z"}}}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-3mqx-f33v-vgp9","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:25:40.222Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:21.141Z"}}},"related_cves":[{"value":"CVE-2026-100651","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:18aefbda-f8dc-4aef-b15d-e958b98a7550","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100651","advisory_id":"18aefbda-f8dc-4aef-b15d-e958b98a7550","event_types":["advisory"],"published_at":"2026-10-24T21:32:12.696145+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:21.141+00:00","detail_url":"/events/3290"},"members":[{"id":3290,"cve_ids":["CVE-2026-100651"],"payload":{"kind":"advisory","title":"vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass","summary":"vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' (multimodal) payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal EngineInput directly from the caller-supplied token_ids, and GenerateRequest.token_ids (vllm/entrypoints/serve/disagg/protocol.py) is not checked against model_config.max_model_len. For multimodal processors that report skip_prompt_length_check=True (for example Nemotron Parse, Whisper, and FireRedLID), InputProcessor._validate_prompt_len() returns immediately for both encoder and decoder prompts, so an overlong prompt becomes an EngineCoreRequest and reaches the worker input-batch copy into a fixed max_model_len-wide NumPy row. A client able to reach the endpoint on an affected model configuration can therefore submit an overlong token_ids list to trigger a worker failure and denial of service. Fixed in 0.29.0.","evidence":"cve:CVE-2026-100651","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100651","aliases":["CVE-2026-100651"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-28T18:25:40.222Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-3mqx-f33v-vgp9","https://www.vulncheck.com/advisories/vllm-before-0.29.0-denial-of-service-via-decoder-prompt-length-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100651","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T18:21:26.899493Z"}}}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-3mqx-f33v-vgp9","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:25:40.222Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:21.141Z"}}},"related_cves":[{"value":"CVE-2026-100651","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:18aefbda-f8dc-4aef-b15d-e958b98a7550","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100651","advisory_id":"18aefbda-f8dc-4aef-b15d-e958b98a7550","event_types":["advisory"],"published_at":"2026-10-24T21:32:12.696145+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:21.141+00:00","detail_url":"/events/3290"}]}},{"id":3276,"cve_ids":["CVE-2026-100647"],"payload":{"kind":"advisory","title":"vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt","summary":"vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP requests with multi-hundred-megabyte salt values that trigger expensive pickle serialization and SHA-256 hashing, stalling the scheduler thread and denying service to all concurrent requests.","evidence":"cve:CVE-2026-100647","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100647","aliases":["CVE-2026-100647"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-28T18:28:14.772Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-wpww-v874-ph2p","https://www.vulncheck.com/advisories/vllm-before-0.29.0-cpu-exhaustion-via-unbounded-cache-salt"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100647","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T18:26:37.598538Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:28:14.772Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:18.240Z"}}},"related_cves":[{"value":"CVE-2026-100647","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:eaf843ca-24b2-4be7-8546-135783bf0484","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100647","advisory_id":"eaf843ca-24b2-4be7-8546-135783bf0484","event_types":["advisory"],"published_at":"2026-10-24T21:32:11.505382+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:18.24+00:00","detail_url":"/advisories/advisory%3Aeaf843ca-24b2-4be7-8546-135783bf0484","group":{"id":"advisory:eaf843ca-24b2-4be7-8546-135783bf0484","revision":1,"primary_event_id":3288,"change":"published","superseded_by":[],"changed":{"id":3288,"cve_ids":["CVE-2026-100647"],"payload":{"kind":"advisory","title":"vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt","summary":"vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP requests with multi-hundred-megabyte salt values that trigger expensive pickle serialization and SHA-256 hashing, stalling the scheduler thread and denying service to all concurrent requests.","evidence":"cve:CVE-2026-100647","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100647","aliases":["CVE-2026-100647"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-28T18:28:14.772Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-wpww-v874-ph2p","https://www.vulncheck.com/advisories/vllm-before-0.29.0-cpu-exhaustion-via-unbounded-cache-salt"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100647","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T18:26:37.598538Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:28:14.772Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:18.240Z"}}},"related_cves":[{"value":"CVE-2026-100647","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:eaf843ca-24b2-4be7-8546-135783bf0484","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100647","advisory_id":"eaf843ca-24b2-4be7-8546-135783bf0484","event_types":["advisory"],"published_at":"2026-10-24T21:32:11.505382+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:18.24+00:00","detail_url":"/events/3288"},"members":[{"id":3288,"cve_ids":["CVE-2026-100647"],"payload":{"kind":"advisory","title":"vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt","summary":"vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP requests with multi-hundred-megabyte salt values that trigger expensive pickle serialization and SHA-256 hashing, stalling the scheduler thread and denying service to all concurrent requests.","evidence":"cve:CVE-2026-100647","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100647","aliases":["CVE-2026-100647"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-28T18:28:14.772Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-wpww-v874-ph2p","https://www.vulncheck.com/advisories/vllm-before-0.29.0-cpu-exhaustion-via-unbounded-cache-salt"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100647","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T18:26:37.598538Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:28:14.772Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:18.240Z"}}},"related_cves":[{"value":"CVE-2026-100647","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:eaf843ca-24b2-4be7-8546-135783bf0484","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100647","advisory_id":"eaf843ca-24b2-4be7-8546-135783bf0484","event_types":["advisory"],"published_at":"2026-10-24T21:32:11.505382+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:18.24+00:00","detail_url":"/events/3288"}]}},{"id":3204,"cve_ids":["CVE-2026-100652"],"payload":{"kind":"advisory","title":"vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids","summary":"vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids to trigger CUDA tensor indexing failures that leave EngineCore in a fatal state requiring service restart.","evidence":"cve:CVE-2026-100652","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100652","aliases":["CVE-2026-100652"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0.22.0","lessThan":"0.24.0","versionType":"semver"},{"status":"unaffected","version":"0.24.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:42:13.668Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-qff2-492f-9fm4","https://www.vulncheck.com/advisories/vllm-0.22.0-through-0.23.0-denial-of-service-via-stop-token-ids"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100652","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:41:47.920735Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:42:13.668Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:21.865Z"}}},"related_cves":[{"value":"CVE-2026-100652","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:00092340-4e7d-4201-b979-ecf62b1db2aa","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100652","advisory_id":"00092340-4e7d-4201-b979-ecf62b1db2aa","event_types":["advisory"],"published_at":"2026-10-24T21:31:24.451215+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:21.865+00:00","detail_url":"/advisories/advisory%3A00092340-4e7d-4201-b979-ecf62b1db2aa","group":{"id":"advisory:00092340-4e7d-4201-b979-ecf62b1db2aa","revision":1,"primary_event_id":3216,"change":"published","superseded_by":[],"changed":{"id":3216,"cve_ids":["CVE-2026-100652"],"payload":{"kind":"advisory","title":"vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids","summary":"vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids to trigger CUDA tensor indexing failures that leave EngineCore in a fatal state requiring service restart.","evidence":"cve:CVE-2026-100652","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100652","aliases":["CVE-2026-100652"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0.22.0","lessThan":"0.24.0","versionType":"semver"},{"status":"unaffected","version":"0.24.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:42:13.668Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-qff2-492f-9fm4","https://www.vulncheck.com/advisories/vllm-0.22.0-through-0.23.0-denial-of-service-via-stop-token-ids"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100652","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:41:47.920735Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:42:13.668Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:21.865Z"}}},"related_cves":[{"value":"CVE-2026-100652","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:00092340-4e7d-4201-b979-ecf62b1db2aa","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100652","advisory_id":"00092340-4e7d-4201-b979-ecf62b1db2aa","event_types":["advisory"],"published_at":"2026-10-24T21:31:24.451215+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:21.865+00:00","detail_url":"/events/3216"},"members":[{"id":3216,"cve_ids":["CVE-2026-100652"],"payload":{"kind":"advisory","title":"vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids","summary":"vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids to trigger CUDA tensor indexing failures that leave EngineCore in a fatal state requiring service restart.","evidence":"cve:CVE-2026-100652","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100652","aliases":["CVE-2026-100652"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0.22.0","lessThan":"0.24.0","versionType":"semver"},{"status":"unaffected","version":"0.24.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:42:13.668Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-qff2-492f-9fm4","https://www.vulncheck.com/advisories/vllm-0.22.0-through-0.23.0-denial-of-service-via-stop-token-ids"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100652","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:41:47.920735Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:42:13.668Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:21.865Z"}}},"related_cves":[{"value":"CVE-2026-100652","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:00092340-4e7d-4201-b979-ecf62b1db2aa","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100652","advisory_id":"00092340-4e7d-4201-b979-ecf62b1db2aa","event_types":["advisory"],"published_at":"2026-10-24T21:31:24.451215+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:21.865+00:00","detail_url":"/events/3216"}]}},{"id":3203,"cve_ids":["CVE-2026-100648"],"payload":{"kind":"advisory","title":"vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding","summary":"vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decoding.","evidence":"cve:CVE-2026-100648","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100648","aliases":["CVE-2026-100648"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:40:42.006Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-jcq2-4gch-5qhf","https://www.vulncheck.com/advisories/vllm-before-0.29.0-uncontrolled-resource-consumption-via-audio-decoding"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100648","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:40:22.871965Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:40:42.006Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:18.965Z"}}},"related_cves":[{"value":"CVE-2026-100648","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:80a4f962-6c9a-421b-9619-8283137a07f2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100648","advisory_id":"80a4f962-6c9a-421b-9619-8283137a07f2","event_types":["advisory"],"published_at":"2026-10-24T21:31:23.277811+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:18.965+00:00","detail_url":"/advisories/advisory%3A80a4f962-6c9a-421b-9619-8283137a07f2","group":{"id":"advisory:80a4f962-6c9a-421b-9619-8283137a07f2","revision":1,"primary_event_id":3214,"change":"published","superseded_by":[],"changed":{"id":3214,"cve_ids":["CVE-2026-100648"],"payload":{"kind":"advisory","title":"vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding","summary":"vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decoding.","evidence":"cve:CVE-2026-100648","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100648","aliases":["CVE-2026-100648"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:40:42.006Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-jcq2-4gch-5qhf","https://www.vulncheck.com/advisories/vllm-before-0.29.0-uncontrolled-resource-consumption-via-audio-decoding"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100648","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:40:22.871965Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:40:42.006Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:18.965Z"}}},"related_cves":[{"value":"CVE-2026-100648","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:80a4f962-6c9a-421b-9619-8283137a07f2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100648","advisory_id":"80a4f962-6c9a-421b-9619-8283137a07f2","event_types":["advisory"],"published_at":"2026-10-24T21:31:23.277811+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:18.965+00:00","detail_url":"/events/3214"},"members":[{"id":3214,"cve_ids":["CVE-2026-100648"],"payload":{"kind":"advisory","title":"vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding","summary":"vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decoding.","evidence":"cve:CVE-2026-100648","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100648","aliases":["CVE-2026-100648"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","lessThan":"0.29.0","versionType":"semver"},{"status":"unaffected","version":"0.29.0","versionType":"semver"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:40:42.006Z","provider":"cve","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-jcq2-4gch-5qhf","https://www.vulncheck.com/advisories/vllm-before-0.29.0-uncontrolled-resource-consumption-via-audio-decoding"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100648","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:40:22.871965Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:40:42.006Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:18.965Z"}}},"related_cves":[{"value":"CVE-2026-100648","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:80a4f962-6c9a-421b-9619-8283137a07f2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100648","advisory_id":"80a4f962-6c9a-421b-9619-8283137a07f2","event_types":["advisory"],"published_at":"2026-10-24T21:31:23.277811+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:18.965+00:00","detail_url":"/events/3214"}]}},{"id":1977,"cve_ids":["CVE-2026-94626"],"payload":{"kind":"advisory","title":"vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size","summary":"vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel OOM-kill of the decode worker process.","evidence":"cve:CVE-2026-94626","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-94626","aliases":["CVE-2026-94626"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"0.29.0"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-24T22:54:41.241Z","provider":"cve","references":["https://github.com/vllm-project/vllm/pull/51137","https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/utils.py#L569-L573","https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/nixl/metadata.py#L277","https://github.com/vllm-project/vllm","https://www.vulncheck.com/advisories/vllm-through-0.29.0-memory-exhaustion-via-unvalidated-nixl-tp-size"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-94626","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:54:32.814414Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:54:41.241Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-21T22:04:15.352Z"}}},"related_cves":[{"value":"CVE-2026-94626","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:13c9f18d-91ef-4b5b-8e86-f49293591fc9","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-94626","advisory_id":"13c9f18d-91ef-4b5b-8e86-f49293591fc9","event_types":["advisory"],"published_at":"2026-10-24T21:10:59.639874+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T22:04:15.352+00:00","detail_url":"/advisories/advisory%3A13c9f18d-91ef-4b5b-8e86-f49293591fc9","group":{"id":"advisory:13c9f18d-91ef-4b5b-8e86-f49293591fc9","revision":1,"primary_event_id":1976,"change":"published","superseded_by":[],"changed":{"id":1976,"cve_ids":["CVE-2026-94626"],"payload":{"kind":"advisory","title":"vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size","summary":"vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel OOM-kill of the decode worker process.","evidence":"cve:CVE-2026-94626","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-94626","aliases":["CVE-2026-94626"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"0.29.0"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-24T22:54:41.241Z","provider":"cve","references":["https://github.com/vllm-project/vllm/pull/51137","https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/utils.py#L569-L573","https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/nixl/metadata.py#L277","https://github.com/vllm-project/vllm","https://www.vulncheck.com/advisories/vllm-through-0.29.0-memory-exhaustion-via-unvalidated-nixl-tp-size"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-94626","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:54:32.814414Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:54:41.241Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-21T22:04:15.352Z"}}},"related_cves":[{"value":"CVE-2026-94626","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:13c9f18d-91ef-4b5b-8e86-f49293591fc9","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-94626","advisory_id":"13c9f18d-91ef-4b5b-8e86-f49293591fc9","event_types":["advisory"],"published_at":"2026-10-24T21:10:59.639874+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T22:04:15.352+00:00","detail_url":"/events/1976"},"members":[{"id":1976,"cve_ids":["CVE-2026-94626"],"payload":{"kind":"advisory","title":"vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size","summary":"vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel OOM-kill of the decode worker process.","evidence":"cve:CVE-2026-94626","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-94626","aliases":["CVE-2026-94626"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"0.29.0"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-24T22:54:41.241Z","provider":"cve","references":["https://github.com/vllm-project/vllm/pull/51137","https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/utils.py#L569-L573","https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/nixl/metadata.py#L277","https://github.com/vllm-project/vllm","https://www.vulncheck.com/advisories/vllm-through-0.29.0-memory-exhaustion-via-unvalidated-nixl-tp-size"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-94626","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:54:32.814414Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:54:41.241Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-21T22:04:15.352Z"}}},"related_cves":[{"value":"CVE-2026-94626","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:13c9f18d-91ef-4b5b-8e86-f49293591fc9","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-94626","advisory_id":"13c9f18d-91ef-4b5b-8e86-f49293591fc9","event_types":["advisory"],"published_at":"2026-10-24T21:10:59.639874+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T22:04:15.352+00:00","detail_url":"/events/1976"}]}},{"id":1731,"cve_ids":["CVE-2026-93841"],"payload":{"kind":"advisory","title":"vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs","summary":"vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing out-of-bounds writes that corrupt concurrent requests' sampler state and alter repetition penalty behavior.","evidence":"cve:CVE-2026-93841","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93841","aliases":["CVE-2026-93841"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"0.29.0"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:23:15.994Z","provider":"cve","references":["https://github.com/vllm-project/vllm/pull/49081","https://github.com/vllm-project/vllm","https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/worker/gpu/sample/penalties.py#L241-L255","https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/worker/gpu/sample/penalties.py#L33-L37","https://www.vulncheck.com/advisories/vllm-through-0.29.0-adjacent-request-sampler-state-corruption-via-unvalidated-prompt-token-ids"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93841","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-21T16:22:54.286847Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-21T20:48:23.522Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:23:15.994Z"}}},"related_cves":[{"value":"CVE-2026-93841","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8404873d-b3b9-4c0f-88d3-41867da67d1e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93841","advisory_id":"8404873d-b3b9-4c0f-88d3-41867da67d1e","event_types":["advisory"],"published_at":"2026-10-24T21:06:14.6441+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T19:06:06.636+00:00","detail_url":"/advisories/advisory%3A8404873d-b3b9-4c0f-88d3-41867da67d1e","group":{"id":"advisory:8404873d-b3b9-4c0f-88d3-41867da67d1e","revision":1,"primary_event_id":1715,"change":"published","superseded_by":[],"changed":{"id":1715,"cve_ids":["CVE-2026-93841"],"payload":{"kind":"advisory","title":"vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs","summary":"vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing out-of-bounds writes that corrupt concurrent requests' sampler state and alter repetition penalty behavior.","evidence":"cve:CVE-2026-93841","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93841","aliases":["CVE-2026-93841"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"0.29.0"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:23:15.994Z","provider":"cve","references":["https://github.com/vllm-project/vllm/pull/49081","https://github.com/vllm-project/vllm","https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/worker/gpu/sample/penalties.py#L241-L255","https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/worker/gpu/sample/penalties.py#L33-L37","https://www.vulncheck.com/advisories/vllm-through-0.29.0-adjacent-request-sampler-state-corruption-via-unvalidated-prompt-token-ids"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93841","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-21T16:22:54.286847Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-21T20:48:23.522Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:23:15.994Z"}}},"related_cves":[{"value":"CVE-2026-93841","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8404873d-b3b9-4c0f-88d3-41867da67d1e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93841","advisory_id":"8404873d-b3b9-4c0f-88d3-41867da67d1e","event_types":["advisory"],"published_at":"2026-10-24T21:06:14.6441+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T19:06:06.636+00:00","detail_url":"/events/1715"},"members":[{"id":1715,"cve_ids":["CVE-2026-93841"],"payload":{"kind":"advisory","title":"vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs","summary":"vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing out-of-bounds writes that corrupt concurrent requests' sampler state and alter repetition penalty behavior.","evidence":"cve:CVE-2026-93841","products":[{"name":{"value":"vllm","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93841","aliases":["CVE-2026-93841"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"0.29.0"}],"packageURL":"pkg:pypi/vllm","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:23:15.994Z","provider":"cve","references":["https://github.com/vllm-project/vllm/pull/49081","https://github.com/vllm-project/vllm","https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/worker/gpu/sample/penalties.py#L241-L255","https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/v1/worker/gpu/sample/penalties.py#L33-L37","https://www.vulncheck.com/advisories/vllm-through-0.29.0-adjacent-request-sampler-state-corruption-via-unvalidated-prompt-token-ids"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93841","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-21T16:22:54.286847Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-21T20:48:23.522Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:23:15.994Z"}}},"related_cves":[{"value":"CVE-2026-93841","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8404873d-b3b9-4c0f-88d3-41867da67d1e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93841","advisory_id":"8404873d-b3b9-4c0f-88d3-41867da67d1e","event_types":["advisory"],"published_at":"2026-10-24T21:06:14.6441+00:00","technologies":["core-cve","vllm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T19:06:06.636+00:00","detail_url":"/events/1715"}]}}],"next_after":52719,"next_before":1731}