SUSE CVE-2026-94627

vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts,...

CVE-2026-93436

A flaw was found in vLLM. A remote attacker can exploit this vulnerability by submitting specially crafted inference requests that are rejected but still cause the system to retain decode-side metadata. This improper cleanup leads to an unbounded exhaustion of decode-worker memory, resulting in a...

SUSE CVE-2026-93560

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service DoS by exhausting memo...

SUSE CVE-2026-93688

SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstraproom values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstraproom...

SUSE CVE-2026-93838

SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handlestagingreq that fails to validate chunkidx from ZMQ STAGINGREQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine's internal ZMQ rank port can send a frame wit...

CVE-2026-94570

SGLang contains a DoS vulnerability caused by missing input validation for AUXDATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial o...

CVE-2026-94570 CVE-2026-94570

SGLang contains a DoS vulnerability caused by missing input validation for AUXDATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial o...

CVE-2026-94570 CVE-2026-94570

SGLang contains a DoS vulnerability caused by missing input validation for AUXDATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial o...

CVE-2026-94570

SGLang is affected by a denial of service (DoS) vulnerability caused by a lack of input validation for AUX_DATA ZeroMQ control messages within the Decode worker . An unauthenticated remote attacker who can reach the Decode control PULL socket can exploit this flaw to terminate the Decode control ...

EUVD-2026-84425

SGLang contains a DoS vulnerability caused by missing input validation for AUXDATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial o...

CVE-2026-87080 Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...

CVE-2026-87080

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...

EUVD-2026-84217

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in...

[SECURITY] Fedora 45 Update: rocdecode-7.2.0-7.fc45

rocDecode is a high-performance video decode SDK for AMD GPUs. Using the rocDecode API, you can access the video decoding features available on your G PU...

PT-2026-96671

Name of the Vulnerable Software and Affected Versions Net::IDN::Punycode::PP versions prior to 2.590 Description The decode punycode function in the pure-Perl decoder incorrectly handles truncated labels. The decoder uses a four-argument substr to read digits and checks the result with defined to...

PT-2026-96667

Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode punycode. The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decode punycode computes the...

PT-2026-96669

Name of the Vulnerable Software and Affected Versions Net::IDN::Punycode versions 2.302 through 2.589 Description An issue exists in the XS backend where the output buffer is leaked whenever a label is rejected in the decode punycode function. The XS backend allocates a scalar before validating...

CVE-2026-94570: Improper Validation of Specified Type of Input

SGLang contains a DoS vulnerability caused by missing input validation for AUXDATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial o...

PT-2026-96670

Name of the Vulnerable Software and Affected Versions Net::IDN::Punycode versions prior to 2.590 Description An issue exists that allows CPU exhaustion due to quadratic insertion cost when decoding long labels in the decode punycode function. In the XS backend, each decoded code point is inserted...

PT-2026-96762

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.20 Description SGLang is subject to a denial of service issue due to missing input validation for AUX DATA ZeroMQ control messages within the Decode worker. An unauthenticated remote attacker with network access to...