115 matches found
CVE-2026-114052
A flaw was found in vLLM. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS via memory exhaustion. When serving MOSS-Audio models, the unauthenticated tokenize endpoint caches processor configurations in an unbounded cache. By submitting requests with...
Allocation of Resources Without Limits or Throttling
Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via MossAudioProcessingInfo.gethfprocessor in MOSS-Audio model serving, which caches a...
CVE-2026-114052
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mmprocessorkwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized melconfig values to...
CVE-2026-114052
The vLLM framework (versions after 0.24.0 and before 0.31.0) contains a memory exhaustion vulnerability within the MOSS-Audio model serving component. The root cause is the use of an unbounded dictionary that caches a processor for every unique request-controlled mm_processor_kwargs value. Unauth...
CVE-2026-114052
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mmprocessorkwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized melconfig values to...
EUVD-2026-107003
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mmprocessorkwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized melconfig values to...
CVE-2026-114052 vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mmprocessorkwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized melconfig values to...
CVE-2026-114052 vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mmprocessorkwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized melconfig values to...
CVE-2026-114052 vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mmprocessorkwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized melconfig values to...
PT-2026-120178
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm processor kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel config values...
vLLM resource management error vulnerability
A resource management error vulnerability exists in vLLM versions from 0.24.0 up to but including 0.31.0. This vulnerability arises because the MOSS-Audio model service stores processor values corresponding to mmprocessorkwargs controlled by requests in an unbounded dictionary. Unauthenticated...
llvm-ir-dataset-utils (0.2.0), ml-compiler-opt (>=0.0.1.dev202306210145, <=0.0.1.dev202401270006) +4 more potentially affected by CVE-2024-8375 via dm-reverb (>=0.7.0, <=0.14.0)
dm-reverb PYPI version =0.7.0, =0.0.1.dev202306210145, =0.0.1, =0.4.4, =3.0.1, =0.0.1, =0.0.2 Source cves: CVE-2024-8375 Source advisory: OSV:PYSEC-2026-2452...
EUVD-2026-43299
A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection Authentication. The manipulation leads to improper authentication. The attack can be initiated remotely. The pull request to fix this iss...
EUVD-2026-43298
A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the component Master Websocket Handler. Executing a manipulation of the argument Agent can lead to missing authorization. It is possible to launch...
CVE-2026-15541
A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the component Master Websocket Handler. Executing a manipulation of the argument Agent can lead to missing authorization. It is possible to launch...
CVE-2026-15542 will-moss Isaiah Websocket Connection Authentication main.go improper authentication
A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection Authentication. The manipulation leads to improper authentication. The attack can be initiated remotely. The pull request to fix this iss...
CVE-2026-15542
A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection Authentication. The manipulation leads to improper authentication. The attack can be initiated remotely. The pull request to fix this iss...
CVE-2026-15542
This CVE affects will-moss Isaiah up to version 1.36.9, specifically the Websocket Connection Authentication component (file app/main.go). The underlying issue is in an unknown function that leads to improper authentication, with the attack described as remote. A fix is not yet merged; the pull r...
CVE-2026-15542 will-moss Isaiah Websocket Connection Authentication main.go improper authentication
A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection Authentication. The manipulation leads to improper authentication. The attack can be initiated remotely. The pull request to fix this iss...
CVE-2026-15542
A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection Authentication. The manipulation leads to improper authentication. The attack can be initiated remotely. The pull request to fix this iss...