{"vulnerability": "cve-2026-7148", "sightings": [{"uuid": "845c1eb5-b6a0-4922-ba1a-08c06f191fdc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71485", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtnmz77lh525", "content": "CVE-2026-71485\nEarlier versions of the Centrifugo real-time messaging server forward certain client-provided header values to backend services. Because those values can be forged, an attacker could pretend to be an authorized\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-22T06:20:04.486348Z"}, {"uuid": "18722f6b-af9a-4606-83d2-fbd7dc36f6ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71485", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtk6wmwavx2e", "content": "CVE-2026-71485 - centrifugo\nThe real\u2011time messaging server Centrifugo (versions before 6.9.0) passes client\u2011supplied header values straight to the backend services it talks to. If a backend uses those\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#centrifugo #centrifugal #CVE #infosec", "creation_timestamp": "2026-08-20T21:30:06.376012Z"}, {"uuid": "28f8fa00-c063-4a1e-94d9-b1b65e20f831", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71485", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtkapah7c62u", "content": "\ud83d\udd34 CVE-2026-71485 - Critical (9.1)\n\nCentrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copi...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-71485/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-20T22:01:46.387353Z"}, {"uuid": "dc2d0162-c11c-4c62-b6f2-75e314285718", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71485", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtkb2r2yin2u", "content": "\ud83d\udea8 CVE-2026-71485 \u2014 CVSS 9.1 CRITICAL\n\nCentrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the cli...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-71485\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-20T22:08:12.064070Z"}, {"uuid": "67292505-6af6-4a5d-bfae-dd689bd0d5ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71486", "type": "seen", "source": "https://gist.github.com/alon710/f1f72dae7d8a1a049a639d5207c64786", "content": "# CVE-2026-71486: CVE-2026-71486: Uncontrolled Resource Consumption in vLLM Derender Endpoints\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71486\n\n## Summary\nCVE-2026-71486 (GHSA-8737-qx52-hjff) is an uncontrolled resource consumption vulnerability in vLLM's derender endpoints before version 0.26.0. An authenticated attacker can supply crafted, deeply nested token structures to exhaust CPU and memory resources, resulting in server denial of service (DoS) or Out of Memory (OOM) crashes. This vulnerability stems from missing input-bounds validation before passing user-supplied structures to computationally intensive decoding routines.\n\n## TL;DR\nAuthenticated attackers can cause a Denial of Service (DoS) or Out of Memory (OOM) crash in vLLM servers by submitting oversized, deeply nested arrays of token IDs or choices to the `/v1/completions/derender` or `/v1/chat/completions/derender` endpoints, which the server detokenized without enforcing structure bounds.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 4.3 (Medium)\n- **EPSS Score**: 0.00341 (27.00% Percentile)\n- **Impact**: Denial of Service (DoS) / OOM Crash\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- vLLM Engine\n- vLLM Scale-Out API Server\n- **vLLM**: < 0.26.0 (Fixed in: `0.26.0`)\n\n## Mitigation\n\n- Upgrade vLLM to version 0.26.0 or newer to enable native input validation bounds.\n- Disable or block access to the `/v1/completions/derender` and `/v1/chat/completions/derender` endpoints at the reverse proxy if scale-out derendering is not required.\n- Enforce strict request body size limits (e.g., < 50 KB) on the reverse proxy or API gateway to prevent transmission of massive JSON payloads.\n- Implement rate limiting per API key to mitigate repetitive resource consumption attempts.\n\n**Remediation Steps:**\n1. Check current vLLM version using the command: `pip show vllm`\n2. Update vLLM to the patched version: `pip install --upgrade vllm>=0.26.0`\n3. Verify the deployment version matches the target version using: `python -c \"import vllm; print(vllm.__version__)\"`\n4. Configure NGINX or your API gateway to drop requests exceeding a specified size or block the `/derender` path entirely if unused.\n\n## References\n\n- [GitHub Security Advisory GHSA-8737-qx52-hjff](https://github.com/vllm-project/vllm/security/advisories/GHSA-8737-qx52-hjff)\n- [NVD CVE-2026-71486 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-71486)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71486) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T03:31:23.111790Z"}]}