CLEANSTART-2026-VN44005 Security fix for CVE-2026-71437 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r1, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1, langfuse-worker 3.224.1-r1, langfuse-worker 3.224.2-r1, langfuse-worker 3.224.4-r1, langfuse-worker 4.0.0-r1, langfuse-worker 4.13.0-r1, langfuse-worker 4.7.0-r1, langfuse-worker 4.7.1-r1

CVE-2026-71437 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JY09186 Security fix for CVE-2026-71436 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r1, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1, langfuse-worker 3.224.1-r1, langfuse-worker 3.224.2-r1, langfuse-worker 3.224.4-r1, langfuse-worker 4.0.0-r1, langfuse-worker 4.13.0-r1, langfuse-worker 4.7.0-r1, langfuse-worker 4.7.1-r1

CVE-2026-71436 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TH91746 Security fix for CVE-2026-50159 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r1, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1, langfuse-worker 3.224.1-r1, langfuse-worker 3.224.2-r1, langfuse-worker 3.224.4-r1, langfuse-worker 4.0.0-r1, langfuse-worker 4.13.0-r1, langfuse-worker 4.7.0-r1, langfuse-worker 4.7.1-r1

CVE-2026-50159 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DT43318 Security fix for ghsa-c2j3-45gr-mqc4 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r2, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1

ghsa-c2j3-45gr-mqc4 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BB38451 Security fix for CVE-2026-65898 applied in: langfuse-worker 3.194.1-r1

Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-NP83776 Security fix for ghsa-55q2-fjhq-7xh7 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r2, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1, langfuse-worker 3.224.1-r1, langfuse-worker 3.224.2-r1, langfuse-worker 3.224.4-r1, langfuse-worker 4.0.0-r1, langfuse-worker 4.7.0-r1, langfuse-worker 4.7.1-r1

ghsa-55q2-fjhq-7xh7 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UN72189 Security fix for ghsa-p63j-vcc4-9vmv applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r2, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1

ghsa-p63j-vcc4-9vmv affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GR75196 Security fix for CVE-2026-50272 applied in: langfuse-worker 3.194.1-r1

Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-EE86998 Security fix for ghsa-9mqv-5hh9-4cgg applied in: langfuse-worker 3.194.1-r2, langfuse-worker 3.216.0-r2, langfuse-worker 3.217.0-r2, langfuse-worker 3.218.0-r2, langfuse-worker 3.219.0-r2, langfuse-worker 3.224.2-r2, langfuse-worker 3.225.0-r2

ghsa-9mqv-5hh9-4cgg affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DX25365 Security fix for ghsa-frvp-7c67-39w9 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.2-r1, langfuse-worker 3.225.0-r1, langfuse-worker 4.13.0-r1, n8n 2.28.0-r2

ghsa-frvp-7c67-39w9 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

SUSE CVE-2026-57173

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the inputaudio handling path for /v1/chat/completions calls AudioMediaIO.loadbytes or AudioMediaIO.loadfile without passing VLLMMAXAUDIODECODEDURATIONS to the shared audio decoder. An unauthenticated client can...

SUSE CVE-2026-93099

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix UAF from worker threads when domains are removed The mbmhandleoverflow and cqmhandlelimbo workers read event counters and may sleep while doing so. They are scheduled via delayedwork embedded in struct...

SUSE CVE-2026-93162

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - cancel work on re-enable SR-IOV timeout The QAT reset worker queues SR-IOV reenable work using a workstruct and completion embedded in an on-stack adfsriovdevdata. If the completion wait times out, the reset worker...

PT-2026-100144

Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-64847: Allocation of Resources Without Limits or Throttling

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...

PT-2026-100619

Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details...

Missing Release of Memory after Effective Lifetime

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the decode-worker process. An attacker can cause memory exhaustion by submitting requests wit...

PYSEC-2026-3996

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with maxtokens=0 to exhaust decode-worker memory without bound until the worker restarts...

PYSEC-0000-CVE-2026-93436

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with maxtokens=0 to exhaust decode-worker memory without bound until the worker restarts...

CVE-2026-93436

vLLM through version 0.29.0 is vulnerable to a memory exhaustion issue in prefill/decode disaggregated deployments. The root cause is a failure to properly clean up decode-side metadata for rejected inference requests. A remote, unauthenticated attacker can submit requests with max_tokens=0 to ex...