CVE-2025-1953

CVE-2025-1953 affects vLLM AIBrix 0.2.0. The issue resides in the Prefix Caching component, specifically file pkg/plugins/gateway/prefixcacheindexer/hash.go, where manipulation leads to insufficiently random values. Public documents describe the vulnerability as having a high attack complexity an...

CVE-2025-1953 vLLM AIBrix Prefix Caching hash.go random values

A vulnerability has been found in vLLM AIBrix 0.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file pkg/plugins/gateway/prefixcacheindexer/hash.go of the component Prefix Caching. The manipulation leads to insufficiently random values. The...

UBUNTU-CVE-2022-49622

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: avoid skb access on nfstolen When verdict is NFSTOLEN, the skb might have been freed. When tracing is enabled, this can result in a use-after-free: 1. access to skb-nftrace 2. access to skb-mark 3. computatio...

CVE-2025-27141 Metabase Enterprise Edition allows cached questions to leak data to impersonated users

Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to versions 1.50.36, 1.51.14, 1.52.11, and 1.53.2 of Metabase Enterprise Edition, users with impersonation permissions may be able to see resul...

CVE-2025-27141 Metabase Enterprise Edition allows cached questions to leak data to impersonated users

Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to versions 1.50.36, 1.51.14, 1.52.11, and 1.53.2 of Metabase Enterprise Edition, users with impersonation permissions may be able to see resul...

CVE-2025-27097

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with...

graphql-mesh 资源管理错误漏洞

graphql-mesh is an application by Arda TANRIKULU Individual Developer. A resource management error vulnerability exists in graphql-mesh, which stems from a flaw in the query variable caching mechanism that can lead to token reuse and memory leaks...

4 bug fix and enhancement update

An update is available for module.squid, squid, libecap, module.libecap. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Squid is a high-performance proxy cachin...

[SECURITY] Fedora 40 Update: rust-tealdeer-1.7.1-3.fc40

Fetch and show tldr help pages for many CLI commands. Full featured offline client with caching support...

[SECURITY] Fedora 41 Update: bind-dyndb-ldap-11.10-33.fc41

This package provides an LDAP back-end plug-in for BIND. It features support for dynamic updates and internal caching, to lift the load off of your LDAP server...

Cache Poisoning

vLLM is vulnerable to Cache Poisoning. The vulnerability is due to hash collisions due to the use of Python's built-in hash function for prefix caching, which makes hashNone a predictable constant value, allowing an attacker to intentionally populate the cache with colliding prompts and interfere...

Azure Linux 3.0 Security Update: coredns (CVE-2024-0874)

The version of coredns installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-0874 advisory. - A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly...

[SECURITY] Fedora 41 Update: rust-tealdeer-1.7.1-3.fc41

Fetch and show tldr help pages for many CLI commands. Full featured offline client with caching support...

[SECURITY] Fedora 41 Update: gotify-desktop-1.3.7-4.fc41

Small Gotify daemon to receive messages and forward them as desktop notificat ions. Read Gotify messages, and forward them as standard desktop notification . Forward message priority. Auto reconnect if server connection is lost and g et missed messages. Automatically download, cache, and show app...

vLLM uses Python 3.12 built-in hash() which leads to predictable hash collisions in prefix cache

Summary Maliciously constructed prompts can lead to hash collisions, resulting in prefix cache reuse, which can interfere with subsequent responses and cause unintended behavior. Details vLLM's prefix caching makes use of Python's built-in hash function. As of Python 3.12, the behavior of hashNon...

The vulnerability of the IBM Automation Decision Services platform for modeling and managing business solutions lies in its ability to disclose information through browser caching. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the IBM Automation Decision Services platform for modeling and managing business solutions relates to the disclosure of information through browser caching. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

F5 Nginx 安全漏洞

F5 Nginx is a lightweight web server/reverse proxy server and email IMAP/POP3 proxy server from F5 USA, distributed under the BSD-like protocol. A security vulnerability exists in F5 Nginx that stems from the use of TLS session tickets or SSL session caching, which could allow an attacker to...

CVE-2024-40642

The netty incubator codec.bhttp is a java language binary http parser. In affected versions the BinaryHttpParser class does not properly validate input values thus giving attackers almost complete control over the HTTP requests constructed from the parsed output. Attackers can abuse several issue...

Malicious Go Package Exploits Module Mirror Caching for Persistent Remote Access

Cybersecurity researchers have called attention to a software supply chain attack targeting the Go ecosystem that involves a malicious package capable of granting the adversary remote access to infected systems. The package, named github.com/boltdb-go/bolt, is a typosquat of the legitimate BoltDB...

Security update for dnsmasq

This update for dnsmasq fixes the following issues: Update to 2.90: CVE-2023-50387, CVE-2023-50868: Fixed a Denial Of Service while trying to validate specially crafted DNSSEC responses bsc1219823, bsc1219826. Fix reversion in --rev-server introduced in 2.88 which caused breakage if the prefix...