vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the flash late-interaction query cache reaches. Summary On late-interaction /score and /rerank deployments...

GHSA-2PHQ-3PHC-84PX vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the flash late-interaction query cache reaches. Summary On late-interaction /score and /rerank deployments...

CVE-2026-105755

The vLLM inference and serving engine (prior to version 0.30.0 ) is vulnerable to a cross-request integrity break in its flash late-interaction scoring at the /score and /rerank endpoints. The root cause is that the system derives the query_key value from the caller-controlled X-Request-Id header...

CVE-2026-105755 vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's querykey value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can...

CVE-2026-105755 vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's querykey value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can...

fish-live-in-trees

Рыбы живут на деревьях Инъекция контекста выравнивания среды выполнения LLM в продакшене RACI Автор: Sean Kavanagh Дата: 2026-02-16 Среда: Gemini 3 Flash бесплатный тариф — публичный продакшен-интерфейс Тип эксплойта: Контекстуальный разворот фактическая точность → межличностная аутентичность...

CVE-2025-47827

CVE-2025-47827 CVE-2025-47827에 대한 개념 증명 및 취약점 보고서. 목차 설명 공개 영향 탐지 완화 조치 바이너리 개념 증명 리소스 설명 IGEL OS v11 이전 버전에서는 igel-flash-driver 모듈이 암호화 서명을 부적절하게 검증하기 때문에 Secure Boot를 우회할 수 있습니다. 궁극적으로 검증되지 않은 SquashFS 이미지에서 조작된 루트 파일시스템을 마운트할 수 있습니다. IGEL OS 10의 igel-flash-driver Linux 커널 모듈에서 암호화 서명을 부적절하게 검증...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: compress: fixed to avoid a use-after-free condition on dic. Call trace: memcpy+0x128/0x250 f2fsreadmultipages+0x940/0xf7c f2fsmpagereadpages+0x5a8/0x624 f2fsreadahead+0x5c/0x110 pagecacheraunbounded+0x1b8/0x590...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: firmwareloader: Block path traversal Most firmware names are hardcoded strings, or are constructed from fairly constrained format strings where the dynamic parts are just some hexadecimal numbers or similar elements. However,...

spidump

spidump — захват и реконструкция трассировки SPI/QSPI spidump разбирает захваты логического анализатора при чтении устройством своей SPI/QSPI NOR флеш-памяти при загрузке и реконструирует образ флеш-памяти из трафика чтения — без необходимости прямого чтения чипа. Набор команд флеш-памяти...

PT-2026-106265

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.30.0 Description In deployments using flash late-interaction scoring, the engine derives worker cache keys for query embeddings from the X-Request-Id header, which is controlled by the caller. A concurrent request that...

SpiMitm

+OPTIONS: ^: SpiMitm - 안티 펌웨어 포렌식을 위한 SPI 플래시 읽기 MitM 공격 PoC 이 PoC는 https://up-board.org/upsquared/specifications/UP Squared에 초점을 맞추고 있습니다. 사용 방법 모든 파일을 edk2-platforms 폴더에 복사한 후, https://www.asset-intertech.com/resources/blog/2020/06/the-up-squared-chronicles-episode-2-building-the-uefi-image/여기에...

Exploit-Writeups

Это коллекция разборов эксплойтов, которые я написал: PS3 lv0ldr SPI MITM...

flash-exploit-defense-system

flash-exploit-defense-system Комплексная многоуровневая система защиты от эксплойтов Adobe Flash CVE CVE-2012-0754, CVE-2015-xxxx, CVE-2016-xxxx, CVE-2018-xxxx с защитой на уровне браузера, мобильных устройств, сервера и системы...

CVE-2025-57428

⚠️ Ce dépôt est maintenu uniquement comme référence pour CVE-2025-57428. Pour les autres avis et mises à jour, veuillez vous référer à : security-advisories. CVE-2025-57428 - Interface de débogage Telnet activée par défaut permet un accès bas niveau à la flash/aux registres Produit concerné...

Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383

Раскрытие конфиденциальной информации через прошивку SPI-флеш-памяти для маршрутизатора Hathway CVE-2024-46383 Описание уязвимости: В ходе оценки безопасности прошивки маршрутизатора было обнаружено, что конфиденциальная информация об устройствах, подключенных к маршрутизатору, таких как мобильны...

CVE-2017-3078

CVE-2017-3078 CVE-2017-3078에 대한 설명 Adobe는 Windows, Macintosh, Linux 및 Chrome OS용 Adobe Flash Player에 대한 보안 업데이트를 발표했습니다. 이 업데이트는 공격자가 영향을 받는 시스템을 제어할 수 있는 심각한 취약점을 해결합니다. 설명 2 : Adobe Flash Player 버전 25.0.0.171 및 이전 버전에는 Adobe Texture FormatATF 모듈에서 악용 가능한 메모리 손상 취약점이 있습니다. 성공적으로 악용될 경우 임의 코드 실행이...

CVE-2015-0311

Перезаливка старого порта эксплойта для CVE-2015-0311 Use-after-free в Adobe Flash Player под Linux/Firefox, созданного мной в образовательных целях...

CVE-2025-51643

CVE-2025-51643: Незащищенная SPI-флэш-память позволяет извлечь прошивку в Meitrack T366G-L Описание Устройства GPS-трекера Meitrack T366G-L содержат чип SPI-флэш-памяти Winbond 25Q64JVSIQ, доступ к которому возможен без аутентификации или защиты от вскрытия. Злоумышленник, имеющий физический...

CheckFlashPlayerVersion

CheckFlashPlayerVersion Vérifie la version de FlashPlayer du navigateur pour savoir si elle est vulnérable à l'exploit CVE-2016-7855 Usage: Clonez ce dépôt puis ouvrez le fichier html dans le navigateur où vous souhaitez vérifier la version de Flash Player...