PT-2026-106271

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.30.0 Description The Rust frontend's track http metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary...

Malicious code in http-metrics-middleware (npm)

npm/http-metrics-middleware is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the improper handling of HTTP metrics. An attacker can cause a denial of service by sending crafted requests that lead to metrics explosion. Remediation There is no fixed versi...

CVE-2023-45142

A memory leak was found in the otelhttp handler of open-telemetry. This flaw allows a remote, unauthenticated attacker to exhaust the server's memory by sending many malicious requests, affecting the availability. Mitigation As a workaround to stop being affected otelhttp.WithFilter can be used...