npm: Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

npm: Seroval fromJSON/fromCrossJSON denial of service via unvalidated array node length vulnerability discovered by ? in WordPress npm seroval versions = 1.4.1, = 1.6.7...

GHSA-WP97-X4HV-QVHP Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Summary fromJSON and fromCrossJSON did not check that an array node's element list is an array. A small crafted payload could set the length the decoder used. That length controlled how much memory was allocated and how many times the decoder looped, and it did not depend on the size of the...

CVE-2024-21762

CVE-2024-21762 out-of-bounds write in Fortinet FortiOS CVE-2024-21762 vulnerability Exploit poc by assetnote ssldohandshakeptr = b"%60%ce%42%00%00%00%00%00" getcwdptr = b"%70%62%2c%04%00%00%00%00" pivot1 = b"%52%f7%fd%00%00%00%00%00" push rdi; pop rsp; ret; pivot2 = b"%ac%c9%ab%02%00%00%00%00" ad...

GHSA-6PWM-X34P-FVJ2 ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

Summary ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did not provide a kernelshape attribute. The inference function derived an empty effectivekernelshape vector from the undersized weight tensor, then...

EUVD-2026-110041

ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank...

ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

Summary ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did not provide a kernelshape attribute. The inference function derived an empty effectivekernelshape vector from the undersized weight tensor, then...

GHSA-Q69G-F4F5-V8M7 ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs

Summary ONNX's Python tensor-materialization helpers could allocate memory according to attacker-controlled tensor dimensions without verifying that a packed sub-byte payload contained the declared number of elements. A very small model could therefore cause a disproportionately large allocation...

ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs

Summary ONNX's Python tensor-materialization helpers could allocate memory according to attacker-controlled tensor dimensions without verifying that a packed sub-byte payload contained the declared number of elements. A very small model could therefore cause a disproportionately large allocation...

GHSA-M4PR-6V3C-6FGR ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

Summary ONNX shape inference did not safely validate the required Scan numscaninputs attribute. Two malformed values could terminate or disrupt the process: 1. If the attribute was missing, ctx.getAttribute"numscaninputs" returned null and was dereferenced. 2. If the attribute was negative,...

ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

Summary ONNX shape inference did not safely validate the required Scan numscaninputs attribute. Two malformed values could terminate or disrupt the process: 1. If the attribute was missing, ctx.getAttribute"numscaninputs" returned null and was dereferenced. 2. If the attribute was negative,...

EUVD-2026-110046

ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute...

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

Summary ONNX shape inference performed an out-of-bounds read when processing a malformed RNN, GRU, or LSTM node from opsets 1–6 whose first input had a rank other than three. RNNShapeInferenceopset1to6 checked whether the input shape was present but accessed dim0 and dim1 without first checking i...

EUVD-2026-110040

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference Old Opsets, Missing Rank Check...

GHSA-48M4-24CQ-37QF ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

Summary ONNX shape inference performed an out-of-bounds read when processing a malformed RNN, GRU, or LSTM node from opsets 1–6 whose first input had a rank other than three. RNNShapeInferenceopset1to6 checked whether the input shape was present but accessed dim0 and dim1 without first checking i...

EUVD-2026-110023

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine...

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

Summary The Phi-4 multimodal audio encoder phi4mmaudio.py / phi4mmutils.py runs its conformer attention in eager mode by default: the official HF config of microsoft/Phi-4-multimodal-instruct does not set useptscaleddotproductattention, so the default False applies phi4mmaudio.py:166, :876;...

Poc

exploit for baseband qualcomm...

GHSA-GQ5Q-89C7-VHVX vLLM DeepSeek-OCR image processing vulnerable to denial of service

Summary Any vLLM deployment serving a model of the DeepSeek-OCR family — deepseek-ai/DeepSeek-OCR, deepseek-ai/DeepSeek-OCR-2, or baidu/Unlimited-OCR whose UnlimitedOCRForCausalLM subclasses DeepseekOCRForCausalLM — can be killed by a single unauthenticated chat request carrying an ordinary,...

vLLM DeepSeek-OCR image processing vulnerable to denial of service

Summary Any vLLM deployment serving a model of the DeepSeek-OCR family — deepseek-ai/DeepSeek-OCR, deepseek-ai/DeepSeek-OCR-2, or baidu/Unlimited-OCR whose UnlimitedOCRForCausalLM subclasses DeepseekOCRForCausalLM — can be killed by a single unauthenticated chat request carrying an ordinary,...

GHSA-H3RC-J82P-2C3H vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

Summary In vLLM 0.30.0, ImageMediaIO passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted formats; the request's MIME label does not constrain decoder selection. An EPS payload labeled image/png reached the host's Ghostscript executable. On a ho...