ctopt (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-31253 via flash-attn (1.0.4)

flash-attn PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on flash-attn and may be impacted: - ctopt =0.1.0, =0.1.2 Source cves: CVE-2026-31253 Source advisory: OSV:GHSA-7G5W-PQ96-8C5W...

airoboros (>=2.1.6, <=2.2.1), bhasa (>=0.1.0, <=0.1.1) +19 more potentially affected by CVE-2026-31253 via flash-attn (>=2.0.8, <=2.8.3)

flash-attn PYPI version =2.0.8, =2.1.6, =0.1.0, =0.1.0, =0.0.5, =0.1.0, =0.2.0rc2, =0.0.1, =0.3.6.post1, =0.1.8, =0.0.1.post1, =0.0.2 and more Source cves: CVE-2026-31253 Source advisory: GHSA-7G5W-PQ96-8C5W...

scpert (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-31253 via flash-attn (0.2.8)

flash-attn PYPI version 0.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on flash-attn and may be impacted: - scpert =0.1.0, =0.1.1 Source cves: CVE-2026-31253 Source advisory: OSV:GHSA-7G5W-PQ96-8C5W...

airoboros (>=2.1.6, <=2.2.1), bhasa (>=0.1.0, <=0.1.1) +19 more potentially affected by CVE-2026-31253 via flash-attn (>=2.0.8, <=2.8.3)

flash-attn PYPI version =2.0.8, =2.1.6, =0.1.0, =0.1.0, =0.0.5, =0.1.0, =0.2.0rc2, =0.0.1, =0.3.6.post1, =0.1.8, =0.0.1.post1, =0.0.2 and more Source cves: CVE-2026-31253 Source advisory: OSV:GHSA-7G5W-PQ96-8C5W...

ochat (3.1.0) potentially affected by CVE-2026-31253 via flash-attn (1.0.9)

flash-attn PYPI version 1.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on flash-attn and may be impacted: - ochat 3.1.0 Source cves: CVE-2026-31253 Source advisory: OSV:GHSA-7G5W-PQ96-8C5W...

CVE-2026-31253

The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 2025-13-04 contains an insecure deserialization vulnerability CWE-502 in its checkpoint loading mechanism. The loadcheckpoint function in checkpoint.py and the checkpoint loading code in eval.py use...

CVE-2026-42608

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the sessionid passed as form-flash-id in POST requests, an unauthenticated attacker can traverse the filesystem to create arbitrary directories an...

CVE-2026-42608 Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the sessionid passed as form-flash-id in POST requests, an unauthenticated attacker can traverse the filesystem to create arbitrary directories an...

CVE-2026-31254

The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 2025-13-04 contains a code injection vulnerability CWE-94 in its training script. The script registers the Python eval function as a Hydra configuration resolver under the name eval. This allows configuration files t...

FlashAttention security vulnerability

FlashAttention is an efficient and memory-efficient attention mechanism implementation tool open-sourced by Dao AI Lab. There is a security vulnerability in FlashAttention; this vulnerability stems from the training script registering the Python eval function as a Hydra configuration parser, whic...

CVE-2026-31253

The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 2025-13-04 contains an insecure deserialization vulnerability CWE-502 in its checkpoint loading mechanism. The loadcheckpoint function in checkpoint.py and the checkpoint loading code in eval.py use...

CVE-2026-31253

The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 2025-13-04 contains an insecure deserialization vulnerability CWE-502 in its checkpoint loading mechanism. The loadcheckpoint function in checkpoint.py and the checkpoint loading code in eval.py use...

CVE-2026-31254: Improper Neutralization of Directives in Dynamically Evaluated Code

The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 2025-13-04 contains a code injection vulnerability CWE-94 in its training script. The script registers the Python eval function as a Hydra configuration resolver under the name eval. This allows configuration files t...

CVE-2026-31253: Improper Control of Generation of Code

The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 2025-13-04 contains an insecure deserialization vulnerability CWE-502 in its checkpoint loading mechanism. The loadcheckpoint function in checkpoint.py and the checkpoint loading code in eval.py use...

PT-2026-39638

Name of the Vulnerable Software and Affected Versions flash-attention training framework versions prior to commit e724e2588cbe754beb97cf7c011b5e7e34119e62 Description An insecure deserialization issue exists in the checkpoint loading mechanism. The load checkpoint function in checkpoint.py and th...

CVE-2026-31254

The flash-attention project (through commit e724e2588cbe754beb97cf7c011b5e7e34119e62 ) is vulnerable to a code injection vulnerability (CWE-94 ) within its training script. The root cause is the registration of the Python eval() function as a Hydra configuration resolver under the name eval. This...

CVE-2026-31253

The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 2025-13-04 contains an insecure deserialization vulnerability CWE-502 in its checkpoint loading mechanism. The loadcheckpoint function in checkpoint.py and the checkpoint loading code in eval.py use...

CVE-2026-43415

A flaw was found in the Linux kernel's Universal Flash Storage UFS host controller driver scsi: ufs: core. A race condition exists during the UFS suspend process, where a timing issue can cause critical operations to execute out of sequence. This can lead to an Asynchronous SError Interrupt and a...

CVE-2026-43349

A flaw was found in the Linux kernel's Flash-Friendly File System f2fs. This vulnerability allows a local attacker to cause an uninitialized value access in the f2fssanitychecknodefooter function. This occurs when the system fails to read data from a device into a folio, potentially leading to...

EUVD-2026-28777

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcdaddcommandtrace The kernel log indicates a crash in ufshcdaddcommandtrace, due to a NULL pointer dereference when accessing hwq-id. This can happen if...