30 matches found
vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object
vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recvobject deserializes received object bytes using pickle.loads without sanitization, leading to a remote code execution vulnerability. Maintainer...
PYSEC-2026-568 vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object
vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recvobject deserializes received object bytes using pickle.loads without sanitization, leading to a remote code execution vulnerability. Maintainer perspective...
PT-2026-53637
vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recv object deserializes received object bytes using pickle.loads without sanitization, leading to a remote code execution vulnerability. Maintainer perspective...
NVIDIA Megatron-LM 代码注入漏洞
NVIDIA Megatron-LM is a distributed training framework based on PyTorch developed by NVIDIA Corporation in the United States. It is specifically designed for training large-scale Transformer language models. NVIDIA Megatron-LM has a code injection vulnerability. This vulnerability stems from...
The Log Aggregator Service’s vulnerability allows attackers to gain unauthorized access to protected information, replace data, enhance their privileges, execute arbitrary code, or cause service failures in large-scale distributed training systems. NVIDIA Resiliency Extension (NVRx) provides tools to improve the fault tolerance of such systems.
The vulnerability of the Log Aggregator Service, a tool designed to enhance the fault tolerance of large-scale distributed training systems, is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow attackers to gain unauthorized access t...
NVIDIA Megatron-LM 代码注入漏洞
NVIDIA Megatron-LM is a PyTorch-based distributed training framework from NVIDIA that is specifically designed for training large Transformer language models. NVIDIA Megatron-LM suffers from a code injection vulnerability that stems from scripts improperly handling malicious data, which could lea...
EUVD-2025-7029
Malicious code in bioql PyPI...
A Lightweight Federated Learning Approach for Privacy-Preserving Botnet Detection in IoT
The rapid growth of the Internet of Things IoT has expanded opportunities for innovation but also increased exposure to botnet-driven cyberattacks. Conventional detection methods often struggle with scalability, privacy, and adaptability in resource-constrained IoT environments. To address these...
PyTorch nccl.py torch.cuda.nccl.reduce denial of service
...
NVIDIA Megatron-LM Code Injection Vulnerability (CNVD-2025-19536)
NVIDIA Megatron-LM is a PyTorch-based distributed training framework from NVIDIA that specializes in training large Transformer language models. NVIDIA Megatron-LM suffers from a code injection vulnerability that originates in the megatron/training/arguments.py component, which can be exploited b...
CVE-2025-50461
A deserialization vulnerability exists in Volcengine's verl 3.0.0, specifically in the scripts/modelmerger.py script when using the "fsdp" backend. The script calls torch.load with weightsonly=False on user-supplied .pt files, allowing attackers to execute arbitrary code if a maliciously crafted...
NVIDIA Megatron-LM 代码注入漏洞
NVIDIA Megatron-LM is a PyTorch-based distributed training framework from NVIDIA that specializes in training large Transformer language models. NVIDIA Megatron-LM suffers from a code injection vulnerability that originates in a tool component and can be exploited by an attacker to modify the...
CVE-2024-9052
A flaw was found in the vLLM distributed training API. This vulnerability allows remote code execution via unsafe deserialization, which uses pickle.loads without sanitization...
CVE-2024-9052
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2024-9052
Summary: CVE-2024-9052 relates to a deserialization flaw in the vLLM project’s distributed training API. The issue enables remote code execution via unsafe deserialization of object bytes using pickle.loads() without sanitization, specifically within the vllm.distributed.GroupCoordinator.recv_obj...
CVE-2024-12044: Deserialization of Untrusted Data
A remote code execution vulnerability exists in open-mmlab/mmdetection version v3.3.0. The vulnerability is due to the use of the pickle.loads function in the allreducedict distributed training API without proper sanitization. This allows an attacker to execute arbitrary code by broadcasting a...
PT-2025-12261
Name of the Vulnerable Software and Affected Versions vllm-project vllm version 0.6.0 Description The issue concerns a remote code execution vulnerability in the distributed training API. Specifically, the vllm.distributed.GroupCoordinator.recv object function deserializes received object bytes...
Out-of-bounds Write
Overview lightgbm is a gradient boosting framework that uses tree based learning algorithms. Affected versions of this package are vulnerable to Out-of-bounds Write in linkerssocket.cpp, used during initialization of distributed training. An attacker can exploit a race condition to connect to a...