vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

SummaryThe OpenAI-compatible chat endpoint accepts request-level video loader options through mediaiokwargs. A caller can select the GLMGA sampler and provide large fps and maxframes values. GLMGA first constructs an attacker-sized Python index list and then deduplicates it, even when the supplie...

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

Affected- Ecosystem / package: pip / vllm- Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the scale-out transport path reaches. SummaryvLLM's disaggregated scale-out transport splits a multimodal...

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

Affected- Ecosystem / package: pip / vllm- Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the loose cachesalt validator and unguarded scheduling-path lookup reach. SummaryvLLM's OpenAI-compatible...

PYSEC-2026-4306 vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the loose cachesalt validator and unguarded scheduling-path lookup reach. Summary vLLM's OpenAI-compatible...

PYSEC-2026-4310 vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

Summary An unauthenticated remote attacker can exhaust the memory of the vLLM API-server process by raising the request-level mediaiokwargs.video.maxframes and fps knobs on any deployment serving a Qwen2-VL or Qwen3-VL model. 74 extra bytes of JSON took the server's peak RSS from 2 271 MiB to 13...

PYSEC-2026-4309 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the scale-out transport path reaches. Summary vLLM's disaggregated scale-out transport splits a multimodal...

PYSEC-2026-4307 vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

Summary The OpenAI-compatible chat endpoint accepts request-level video loader options through mediaiokwargs. A caller can select the GLMGA sampler and provide large fps and maxframes values. GLMGA first constructs an attacker-sized Python index list and then deduplicates it, even when the suppli...

LangGraph SDK custom auth silently ignores actions= on resource decorators

ImpactWhat kind of vulnerability is it? Who is impacted?langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons.In affected versions, a decorator such...

Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Summary The ODF backend resolves the xlink:href of a draw:image element as a filesystem path wheneverthe referenced part is not found inside the document archive. The value comes straight fromcontent.xml, so it is document content, and it is used with no scheme check, no confinement tothe...

PYSEC-2026-4217 fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

Summary fsspec.implementations.reference.ReferenceFileSystem parses a "references" JSON document Kerchunk format supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template....render... calls in three locations. An attacker who controls the...

PYSEC-2026-4240 LangGraph SDK custom auth silently ignores actions= on resource decorators

Impact What kind of vulnerability is it? Who is impacted? langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons. In affected versions, a decorator such as: python...

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

Summaryfsspec.implementations.reference.ReferenceFileSystem parses a "references"JSON document Kerchunk format supplied either inline or via a URL. Theparser renders fields from this JSON through un-sandboxedjinja2.Template....render... calls in three locations. An attacker whocontrols the JSON...

PYSEC-2026-4207 Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Summary The ODF backend resolves the xlink:href of a draw:image element as a filesystem path whenever the referenced part is not found inside the document archive. The value comes straight from content.xml, so it is document content, and it is used with no scheme check, no confinement to the...

DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools

DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowedmcptools function returning None instead of a denied result when mcptools is omitted from a user's grant in...

PYSEC-2026-4220 Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Summary The Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious...

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

SummaryThe Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious...

PYSEC-2026-4206 DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools

DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowedmcptools function returning None instead of a denied result when mcptools is omitted from a user's grant in...

python-jose algorithm confusion guard bypassed by DER-encoded public keys

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

PYSEC-2026-4298 python-jose algorithm confusion guard bypassed by DER-encoded public keys

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware

ImpactSince version 1.4.0, Scrapy respects the Referrer-Policy response header to decide whether and how to set a Referer header on follow-up requests.If the header value looked like a valid Python import path, Scrapy would import the referenced object and call it, assuming it referred to a...