vLLM Denial of Service via the best_of parameter

A vulnerability was found in the ilab model serve component, where improper handling of the bestof parameter in the vllm JSON web API can lead to a Denial of Service DoS. The API used for LLM-based sentence or chat completion accepts a bestof parameter to return the best completion from several...

GHSA-WC36-9694-F9RF vLLM Denial of Service via the best_of parameter

A vulnerability was found in the ilab model serve component, where improper handling of the bestof parameter in the vllm JSON web API can lead to a Denial of Service DoS. The API used for LLM-based sentence or chat completion accepts a bestof parameter to return the best completion from several...

CVE-2024-8768

A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service...

CVE-2024-8939

A vulnerability was found in the ilab model serve component, where improper handling of the bestof parameter in the vllm JSON web API can lead to a Denial of Service DoS. The API used for LLM-based sentence or chat completion accepts a bestof parameter to return the best completion from several...

CVE-2024-8939 Vllm: denials of service in vllm json web api

A vulnerability was found in the ilab model serve component, where improper handling of the bestof parameter in the vllm JSON web API can lead to a Denial of Service DoS. The API used for LLM-based sentence or chat completion accepts a bestof parameter to return the best completion from several...

CVE-2024-8939

CVE-2024-8939 affects the ilab model serve component, specifically the vllm JSON web API. Improper handling of the optional best_of parameter when set to a large value can exhaust resources and cause a Denial of Service, rendering the API unresponsive to legitimate users. Exploitation details in ...

CVE-2024-8939 Vllm: denials of service in vllm json web api

A vulnerability was found in the ilab model serve component, where improper handling of the bestof parameter in the vllm JSON web API can lead to a Denial of Service DoS. The API used for LLM-based sentence or chat completion accepts a bestof parameter to return the best completion from several...

CVE-2024-8768 Vllm: a completions api request with an empty prompt will crash the vllm api server.

A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service...

CVE-2024-8768

CVE-2024-8768 affects the vLLM library: a completions API request with an empty prompt can crash the vLLM API server, causing a DoS. Public metrics show CVSS v3.1 base score 7.5 (Network assault vector, Low attack complexity, No privileges, No user interaction required, Availability impact High)....

CVE-2024-8768 Vllm: a completions api request with an empty prompt will crash the vllm api server.

A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service...

CVE-2024-8768 Vllm: a completions api request with an empty prompt will crash the vllm api server.

A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service...

CVE-2024-8939

A vulnerability was found in the ilab model serve component, where improper handling of the bestof parameter in the vllm JSON web API can lead to a Denial of Service DoS. The API used for LLM-based sentence or chat completion accepts a bestof parameter to return the best completion from several...

PT-2024-39237

Name of the Vulnerable Software and Affected Versions: vLLM library affected versions not specified Description: A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service. Recommendations: At the moment,...

vLLM 资源管理错误漏洞

vLLM is a vLLM open source high throughput and memory efficient reasoning and service engine for LLM. A resource management error vulnerability exists in vLLM 0.5.0.post1 and prior versions, which stems from mishandling the bestof parameter in the vLLM JSON web API, resulting in a denial of servi...

PT-2024-39324

Name of the Vulnerable Software and Affected Versions: ilab model serve component affected versions not specified Description: A vulnerability was found in the ilab model serve component, where improper handling of the best of parameter in the vllm JSON web API can lead to a Denial of Service DoS...

CVE-2024-8768

A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service. Mitigation Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example...

CVE-2024-4839 CSRF in Servers Configurations in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest. The affected functions include Elastic search Service under construction, XTTS service, Petals service, vLLM service, and Motion Ctrl service,...

CVE-2024-4839 CSRF in Servers Configurations in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest. The affected functions include Elastic search Service under construction, XTTS service, Petals service, vLLM service, and Motion Ctrl service,...

CVE-2024-4839

CVE-2024-4839 affects parisneo/lollms-webui, versions 9.6 through the latest. The vulnerability is a CSRF flaw in the 'Servers Configurations' function that guards several components (Elastic search Service, XTTS service, Petals service, vLLM service, Motion Ctrl service). The root cause is lack ...

LoLLMs Cross-Site Request Forgery Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A cross-site request forgery vulnerability exists in LoLLMs version 9.6 and prior versions, which stems from a lack of cross-site request forgery protection in the Elastic Search Service, XTTS...