FlowiseAI-Critical-KillChain

FlowiseAI — 중요 킬 체인 FlowiseAI = 3.0.5에 대해 인증되지 않은 계정 탈취와 원격 코드 실행이 연쇄적으로 발생합니다. 5초 이내 에 전체 컨테이너가 손상되며, 자격 증명이 전혀 필요하지 않습니다. 킬 체인 왼쪽: FlowiseAI 로그인 페이지 — 오른쪽: CVE-2025-59528을 통한 루트 셸 · uid=0root 목차 작동 방식 — 개요 취약점 세부 정보 CVE-2025-58434 — 토큰 노출 CVE-2025-59528 — 원격 코드 실행 이 연쇄 공격이 치명적인 이유 익스플로잇 코드 설명 사...

SUSE CVE-2026-94626

vLLM through 0.29.0 fails to validate the tpsize parameter in kvtransferparams on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tpsize values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel...

psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

Summary PSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

EUVD-2026-84220

vLLM through 0.29.0 fails to validate the tpsize parameter in kvtransferparams on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tpsize values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel...

Memory Allocation with Excessive Size Value

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the tpsize parameter in kvtransferparams on OpenAI-compatible completion endpoints, which is not...

PYSEC-2026-4008

vLLM through 0.29.0 fails to validate the tpsize parameter in kvtransferparams on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tpsize values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel...

CVE-2026-94626

vLLM through 0.29.0 fails to validate the tpsize parameter in kvtransferparams on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tpsize values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel...

CVE-2026-94626

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints. In prefill/decode disaggregated deployments using NIXL, an unauthenticated remote attacker can supply an arbitrary tp_size value to allocate unbounded memory , ultimately t...

CVE-2026-94626 vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size

vLLM through 0.29.0 fails to validate the tpsize parameter in kvtransferparams on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tpsize values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel...

CVE-2026-94626 vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size

vLLM through 0.29.0 fails to validate the tpsize parameter in kvtransferparams on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tpsize values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel...

PT-2026-96316

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.1 Description OpenAI-compatible completion endpoints fail to validate the tp size parameter within kv transfer params. In prefill/decode disaggregated deployments, an attacker can provide arbitrary values for tp siz...

CVE-2026-94626: Memory Allocation with Excessive Size Value

vLLM through 0.29.0 fails to validate the tpsize parameter in kvtransferparams on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tpsize values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel...

CVE-2026-92983

InternLM LMDeploy through 0.17.0 is affected by a memory exhaustion vulnerability in its DistServe prefill/decode disaggregation mode . The root cause is that the proxy uses user-facing session IDs instead of internal scheduler keys, causing scheduler sessions to never be released. An unauthentic...

CVE-2026-92983 InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate...

valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free

A flaw was found in Valkey. An authenticated client can trigger a CLIENT KILL command while the tlsProcessPendingData function iterates a pending list. This action causes connTLSClose to delete the iterator's cached next node, leading to a use-after-free vulnerability. This flaw, when Transport...

GHSA-R2PF-9CW4-5J65 node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

SUMMARY ------- A combination of bugs in node-opcua causes unlimited TCP socket accumulation FIN-WAIT-2 state during automatic reconnection, leading to memory exhaustion and eventual container/process crash OOM kill. The issue is triggered by the default configuration keepSessionAlive: true when...

EUVD-2026-80403

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: unsubscribe the channel-kill event before the fence context nouveauchanneldel tears the fence context down first and only drops the channel-kill subscription later, in the middle of the nvif object teardown: if...

CVE-2026-89803 drm/nouveau: unsubscribe the channel-kill event before the fence context

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: unsubscribe the channel-kill event before the fence context nouveauchanneldel tears the fence context down first and only drops the channel-kill subscription later, in the middle of the nvif object teardown: if...

CVE-2026-89803

CVE-2026-89803 is a use-after-free in the Linux kernel's DRM/Nouveau driver. In nouveau_channel_del(), the fence context is destroyed before the channel-kill event subscription is dropped, leaving a narrow window where a kill event handler can dereference an already-freed fence context. The bug i...

CVE-2026-89803 drm/nouveau: unsubscribe the channel-kill event before the fence context

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: unsubscribe the channel-kill event before the fence context nouveauchanneldel tears the fence context down first and only drops the channel-kill subscription later, in the middle of the nvif object teardown: if...