Summary
Ein Angreifer kann mehrere Schwachstellen in vllm ausnutzen, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.
Product
Open Source vLLM ist eine Open-Source-Bibliothek für schnelle und effiziente Inferenz von Large Language Models (LLMs).
Vulnerabilities 2
-
Medium 6.5
vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload
vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions…
-
Low 2.6
vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel
vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT (Time…
Revision history
-
#2
CVE ergänzt
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-935w-9g4m-p28p vom 2026-09-27
https://github.com/vllm-project/vllm/security/advisories/GHSA-935w-9g4m-p28p
-
GitHub Security Advisory GHSA-m52c-39rh-f3gp vom 2026-09-27
https://github.com/vllm-project/vllm/security/advisories/GHSA-m52c-39rh-f3gp
-
GitHub Security Advisory GHSA-4qjh-9fv9-r85r vom 2025-05-28
https://github.com/vllm-project/vllm/security/advisories/GHSA-4qjh-9fv9-r85r