CVE-2026-94570 CVE-2026-94570

SGLang contains a DoS vulnerability caused by missing input validation for AUXDATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial o...

CVE-2026-94570 CVE-2026-94570

SGLang contains a DoS vulnerability caused by missing input validation for AUXDATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial o...

CVE-2026-87080 Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...

CVE-2026-87080

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...

EUVD-2026-84217

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in...

[SECURITY] Fedora 45 Update: rocdecode-7.2.0-7.fc45

rocDecode is a high-performance video decode SDK for AMD GPUs. Using the rocDecode API, you can access the video decoding features available on your G PU...

CVE-2026-94570: Improper Validation of Specified Type of Input

SGLang contains a DoS vulnerability caused by missing input validation for AUXDATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial o...

PT-2026-96670

Name of the Vulnerable Software and Affected Versions Net::IDN::Punycode versions prior to 2.590 Description An issue exists that allows CPU exhaustion due to quadratic insertion cost when decoding long labels in the decode punycode function. In the XS backend, each decoded code point is inserted...

PT-2026-96671

Name of the Vulnerable Software and Affected Versions Net::IDN::Punycode::PP versions prior to 2.590 Description The decode punycode function in the pure-Perl decoder incorrectly handles truncated labels. The decoder uses a four-argument substr to read digits and checks the result with defined to...

PT-2026-96667

Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode punycode. The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decode punycode computes the...

PT-2026-96762

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.20 Description SGLang is subject to a denial of service issue due to missing input validation for AUX DATA ZeroMQ control messages within the Decode worker. An unauthenticated remote attacker with network access to...

PT-2026-96669

Name of the Vulnerable Software and Affected Versions Net::IDN::Punycode versions 2.302 through 2.589 Description An issue exists in the XS backend where the output buffer is leaked whenever a label is rejected in the decode punycode function. The XS backend allocates a scalar before validating...

Reachable Assertion

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Reachable Assertion via an assertion failure in NixlBaseConnectorWorker.applyprefixcaching, which fails to properly validate block counts across...

PYSEC-2026-4005

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in...

CVE-2026-94627 vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision

vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts,...

CVE-2026-94623 vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in...

netwatch v0.32.3

NetWatch Network diagnostics in your terminal. netwatch --view dense. Four boxes, no chrome, every keybind on a border. Download grows up from the axis, upload grows down. One binary, no config. sudo netwatch and you have live capture with L7 decode, process attribution where available, and a...

CVE-2026-94627: Missing Release of Memory after Effective Lifetime

vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts,...

CVE-2026-94623: Reachable Assertion

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in...

PT-2026-96293

Name of the Vulnerable Software and Affected Versions FalkorDB Redis module versions 4.20.1 through 4.20.4 Description A buffer overflow exists in the Decode GrB Matrix function located in /v19/decode matrix.c. This flaw allows an attacker to trigger a Denial of Service DoS by providing a special...