EUVD-2026-98092

A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function isglobalip of the file mistralrs-server-core/src/mediasource.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been...

EUVD-2026-98169

A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibrationapply of the file mistralrs-server-core/src/handlers.rs. Performing a manipulation of the argument savecimatrix results in path traversal. The attack may be initiated remotely. The...

CVE-2026-108939

A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function isglobalip of the file mistralrs-server-core/src/mediasource.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been...

CVE-2026-108940

A path traversal vulnerability exists in EricLBuehler Mistral.rs up to version 0.9.3 . The flaw is located in the calibration_apply function within mistralrs-server-core/src/handlers.rs, where a manipulation of the save_cimatrix argument allows for unauthorized file system access. This vulnerabil...

CVE-2026-108939

The EricLBuehler mistral.rs library (versions up to 0.9.3 ) is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The flaw exists in the is_global_ip function within the mistralrs-server-core/src/media_source.rs file, where manipulation of the ip argument allows for remote exploita...

CVE-2026-108939 EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery

A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function isglobalip of the file mistralrs-server-core/src/mediasource.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been...

CVE-2026-75090: Out-of-bounds Read

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convertgguftohftokenizer of the file mistralrs-core/src/gguf/gguftokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eostokenid/bostokenid/unknowntokenid results...