CVE-2026-73558

vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x 2 d in activationkernels.cu can cause actandmulkernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or...

ALPINE-CVE-2026-70462

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...

AZL-95840 CVE-2026-70462 affecting package rsync for versions less than 3.5.0-1

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...

CVE-2026-70462

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...

CVE-2026-73558

vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x 2 d in activationkernels.cu can cause actandmulkernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or...

CVE-2026-73558

The CVE concerns vLLM, an inference/serving engine for LLMs. Before version 0.27.0, an integer overflow in blockIdx.x * 2 * d within activation_kernels.cu enables act_and_mul_kernel to consume input from another user within the same inference batch, causing cross-user data leakage of partial or c...

CVE-2026-73558

vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x 2 d in activationkernels.cu can cause actandmulkernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or...

CVE-2026-73558 vLLM: Cross-User Data Leak Vulnerability

vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x 2 d in activationkernels.cu can cause actandmulkernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or...

CVE-2026-73558 vLLM: Cross-User Data Leak Vulnerability

vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x 2 d in activationkernels.cu can cause actandmulkernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or...

CVE-2026-73558 vLLM: Cross-User Data Leak Vulnerability

vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x 2 d in activationkernels.cu can cause actandmulkernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or...

CVE-2026-70462 rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...

CVE-2026-70462

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...

EUVD-2026-58042

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...

CVE-2026-70462

CVE-2026-70462 affects rsync 3.1.0 prior to 3.5.0. The vulnerability is a signed integer overflow in the I/O timeout implementation triggered by crafted MSG_IO_TIMEOUT messages carrying non-positive values. This can wrap the timeout variable to a non-positive value, preventing the timeout check f...

CVE-2026-70462

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...

CVE-2026-70462

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...

CVE-2026-70462 rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...

CVE-2026-70462 rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...

OESA-2026-3391 coreutils security update

These are the GNU core utilities. This package is the combination of the old GNU fileutils, sh-utils, and textutils packages. Security Fixes: GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop -t...

OESA-2026-3390 coreutils security update

These are the GNU core utilities. This package is the combination of the old GNU fileutils, sh-utils, and textutils packages. Security Fixes: GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop -t...