355 matches found
CVE-2026-73556 vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structuredoutputs.regex parameter in vllm/v1/structuredoutput/backendlmformatenforcer.py is passed to lmformatenforcer.RegexParser without compileregexwithtimeout or validation in...
CVE-2026-73556 vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structuredoutputs.regex parameter in vllm/v1/structuredoutput/backendlmformatenforcer.py is passed to lmformatenforcer.RegexParser without compileregexwithtimeout or validation in...
PT-2026-71671
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.26.0 Description An unauthenticated request to the '/v1/completions' endpoint can cause a denial of service by consuming a CPU core and stalling the structured-output engine path. This occurs because the structured...
CVE-2026-68084 staging: vme_user: fix location monitor leak in tsi148 bridge
In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: fix location monitor leak in tsi148 bridge tsi148probe allocates a location monitor resource and links it into tsi148bridge-lmresources. The probe error path frees this list, but tsi148remove only frees the dma,...
CVE-2026-68084
The CVE concerns the Linux kernel staging: vme_user component, specifically the tsi148 bridge. The root cause is a leaked location monitor resource (lm_resources) because tsi148_remove() did not free lm_resources when unbinding or unloading, unlike other resources. The fix is to free the lm_resou...
PT-2026-59150
A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api generate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be...
FastChat open redirect vulnerability
An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft...
CVE-2026-6608
A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function addtext of the component Arena Side-by-Side View Handler. The manipulation results in incorrect control flow. The attack can be launched remotely. The exploit is now public and may be used. The root cause was...
The vulnerability of the training library for NVIDIA Megatron-LM, related to the restoration of unreliable data in memory, allows attackers to execute arbitrary code, gain unauthorized access to protected information, and replace data.
The vulnerability of the NVIDIA Megatron-LM training library relates to the restoration of unreliable data in memory. Exploiting this vulnerability can allow attackers to execute arbitrary code, gain elevated privileges, obtain unauthorized access to protected information, and replace data using ...
The vulnerability of the training library for NVIDIA Megatron-LM, related to the restoration of unreliable data in memory, allows attackers to execute arbitrary code, gain unauthorized access to protected information, and replace data.
The vulnerability of the NVIDIA Megatron-LM training library relates to the restoration of unreliable data in memory. Exploiting this vulnerability can allow attackers to execute arbitrary code, gain elevated privileges, obtain unauthorized access to protected information, and replace data using ...
The vulnerability of the training library for NVIDIA Megatron-LM, related to the restoration of unreliable data in memory, allows attackers to execute arbitrary code, gain unauthorized access to protected information, and replace data.
The vulnerability of the NVIDIA Megatron-LM training library relates to the restoration of unreliable data in memory. Exploiting this vulnerability can allow attackers to execute arbitrary code, gain elevated privileges, obtain unauthorized access to protected information, and replace data using ...
The vulnerability of the training library for NVIDIA Megatron-LM, related to the restoration of unreliable data in memory, allows attackers to execute arbitrary code, gain unauthorized access to protected information, and replace data.
The vulnerability of the NVIDIA Megatron-LM training library relates to the restoration of unreliable data in memory. Exploiting this vulnerability can allow attackers to execute arbitrary code, gain elevated privileges, obtain unauthorized access to protected information, and replace data...
The vulnerability of the hybrid transformation library’s script for training large language models like NVIDIA Megatron-LM allows attackers to execute arbitrary code, gain elevated privileges, obtain unauthorized access to protected information, and perform data substitution attacks.
The vulnerability of the hybrid transformation library for training large language models like NVIDIA Megatron-LM involves the restoration of unreliable data in memory. Exploiting this vulnerability can allow attackers to execute arbitrary code, gain elevated privileges, obtain unauthorized acces...
CVE-2026-5843 Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loading
The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the modelfile configuration field in config.json. When a model's config.json specifies a modelfile pointing to a Python...
PT-2026-42831
Name of the Vulnerable Software and Affected Versions Docker Model Runner on macOS affected versions not specified Description The MLX inference backend uses the MLX-LM library, which imports and executes arbitrary Python files from model directories via the model file configuration field in the...
NVIDIA TRT-LLM 安全漏洞
NVIDIA TRT-LM is a high-performance inference framework developed by NVIDIA Corporation for optimizing the inference acceleration and deployment of large language models. NVIDIA TRT-LM contains a security vulnerability, which stems from unchecked return values leading to null pointer dereferencin...
NVIDIA TRT-LLM 代码问题漏洞
NVIDIA TRT-LM is a high-performance inference framework developed by NVIDIA Corporation for optimizing the inference acceleration and deployment of large language models. NVIDIA TRT-LM has code-related vulnerabilities, including deserialization vulnerabilities and insecure serialization handles,...
NVIDIA TRT-LLM 代码问题漏洞
NVIDIA TRT-LM is a high-performance inference framework developed by NVIDIA Corporation for optimizing the inference acceleration and deployment of large language models. NVIDIA TRT-LM has code-related vulnerabilities, which stem from insecure deserialization during RPC tests. These vulnerabiliti...
EUVD-2026-23778
A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function apigenerate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be...
EUVD-2026-23780
A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function addtext of the component Arena Side-by-Side View Handler. The manipulation results in incorrect control flow. The attack can be launched remotely. The exploit is now public and may be used. The root cause was...