Denial of Service (DoS)

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Denial of Service DoS via the HTTP metrics middleware in rust/src/server/src/middleware/metrics.rs, where arbitrary HTTP method tokens sent by an...

PT-2026-106271

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.30.0 Description The Rust frontend's track http metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary...

PT-2026-122457

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track http metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method token...

Malware in http-metrics-middleware

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in http-metrics-middleware (npm)

npm/http-metrics-middleware is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the improper handling of HTTP metrics. An attacker can cause a denial of service by sending crafted requests that lead to metrics explosion. Remediation There is no fixed versi...

CVE-2023-45142

A memory leak was found in the otelhttp handler of open-telemetry. This flaw allows a remote, unauthenticated attacker to exhaust the server's memory by sending many malicious requests, affecting the availability. Mitigation As a workaround to stop being affected otelhttp.WithFilter can be used...