Vulnerability-Lookup

URL	Tags
https://github.com/vllm-project/vllm/security/adv…	x_refsource_CONFIRM

Vendor	Product	Version	CPE status
vllm-project	vllm	Affected: >= 0.16.0, < 0.19.0	guessed

FKIE_CVE-2026-34753

Vulnerability from fkie_nvd - Published: 2026-04-06 16:16 - Updated: 2026-06-17 10:39

Severity

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Summary

vLLM is an inference and serving engine for large language models (LLMs). From 0.16.0 to before 0.19.0, a server-side request forgery (SSRF) vulnerability in download_bytes_from_url allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain restrictions. This can be used to target internal services (e.g. cloud metadata endpoints or internal HTTP APIs) reachable from the vLLM host. This vulnerability is fixed in 0.19.0.

References

	URL	Tags
	security-advisories@github.com	https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr	Patch, Vendor Advisory

Impacted products

	Vendor	Product	Version
	vllm	vllm	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "vllm",
          "vendor": "vllm-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.16.0, \u003c 0.19.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8669DB6-DED0-403B-A294-BBF70600B90F",
              "versionEndExcluding": "0.19.0",
              "versionStartIncluding": "0.16.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "vLLM is an inference and serving engine for large language models (LLMs). From 0.16.0 to before 0.19.0, a server-side request forgery (SSRF) vulnerability in download_bytes_from_url allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain restrictions.\nThis can be used to target internal services (e.g. cloud metadata endpoints or internal HTTP APIs) reachable from the vLLM host. This vulnerability is fixed in 0.19.0."
    }
  ],
  "id": "CVE-2026-34753",
  "lastModified": "2026-06-17T10:39:33.803",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34753",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-07T14:15:25.238259Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-06T16:16:36.307",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-PF3H-QJGV-VCPR

Vulnerability from github – Published: 2026-04-03 21:51 – Updated: 2026-07-17 16:18

Summary

vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `

Details

Summary

A Server Side Request Forgery (SSRF) vulnerability in download_bytes_from_url allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain restrictions.

This can be used to target internal services (e.g. cloud metadata endpoints or internal HTTP APIs) reachable from the vLLM host.

Details

Vulnerable component

The vulnerable logic is in the batch runner entrypoint vllm/entrypoints/openai/run_batch.py, function download_bytes_from_url:

# run_batch.py Lines 442-482
async def download_bytes_from_url(url: str) -> bytes:
    """
    Download data from a URL or decode from a data URL.

    Args:
        url: Either an HTTP/HTTPS URL or a data URL (data:...;base64,...)

    Returns:
        Data as bytes
    """
    parsed = urlparse(url)

    # Handle data URLs (base64 encoded)
    if parsed.scheme == "data":
        # Format: data:...;base64,<base64_data>
        if "," in url:
            header, data = url.split(",", 1)
            if "base64" in header:
                return base64.b64decode(data)
            else:
                raise ValueError(f"Unsupported data URL encoding: {header}")
        else:
            raise ValueError(f"Invalid data URL format: {url}")

    # Handle HTTP/HTTPS URLs
    elif parsed.scheme in ("http", "https"):
        async with (
            aiohttp.ClientSession() as session,
            session.get(url) as resp,
        ):
            if resp.status != 200:
                raise Exception(
                    f"Failed to download data from URL: {url}. Status: {resp.status}"
                )
            return await resp.read()

    else:
        raise ValueError(
            f"Unsupported URL scheme: {parsed.scheme}. "
            "Supported schemes: http, https, data"
        )

Key properties:

The function only parses the URL to dispatch on the scheme (data, http, https).
For http / https, it directly calls session.get(url) on the provided string.
There is no validation of:
hostname or IP address,
whether the target is internal or external,
port number,
path, query, or redirect target.
This is in contrast to the multimodal media path (MediaConnector), which implements an explicit domain allowlist. download_bytes_from_url does not reuse that protection.

URL controllability

The url argument is fully controlled by batch input JSON via the file_url field of BatchTranscriptionRequest / BatchTranslationRequest.

Batch request body type:

# run_batch.py Line 67-80
class BatchTranscriptionRequest(TranscriptionRequest):
    """
    Batch transcription request that uses file_url instead of file.

    This class extends TranscriptionRequest but replaces the file field
    with file_url to support batch processing from audio files written in JSON format.
    """

    file_url: str = Field(
        ...,
        description=(
            "Either a URL of the audio or a data URL with base64 encoded audio data. "
        ),
    )

# run_batch.py Line 98-111
class BatchTranslationRequest(TranslationRequest):
    """
    Batch translation request that uses file_url instead of file.

    This class extends TranslationRequest but replaces the file field
    with file_url to support batch processing from audio files written in JSON format.
    """

    file_url: str = Field(
        ...,
        description=(
            "Either a URL of the audio or a data URL with base64 encoded audio data. "
        ),
    )

There is no restriction on the domain, IP, or port of file_url in these models.

Batch input is parsed directly from the batch file:

# run_batch.py Line 139-179
class BatchRequestInput(OpenAIBaseModel):
    ...
    url: str
    body: BatchRequestInputBody
    @field_validator("body", mode="plain")
    @classmethod
    def check_type_for_url(cls, value: Any, info: ValidationInfo):
        url: str = info.data["url"]
        ...
        if url == "/v1/audio/transcriptions":
            return BatchTranscriptionRequest.model_validate(value)
        if url == "/v1/audio/translations":
            return BatchTranslationRequest.model_validate(value)

# run_batch.py Line 770-781
   logger.info("Reading batch from %s...", args.input_file)

    # Submit all requests in the file to the engine "concurrently".
    response_futures: list[Awaitable[BatchRequestOutput]] = []
    for request_json in (await read_file(args.input_file)).strip().split("\n"):
        # Skip empty lines.
        request_json = request_json.strip()
        if not request_json:
            continue

        request = BatchRequestInput.model_validate_json(request_json)

The batch runner reads each line of the input file (args.input_file), parses it as JSON, and constructs a BatchTranscriptionRequest / BatchTranslationRequest. Whatever file_url appears in that JSON line becomes batch_request_body.file_url.

file_url is passed directly into download_bytes_from_url:

# run_batch.py Line 610-623
def wrapper(handler_fn: Callable):
        async def transcription_wrapper(
            batch_request_body: (BatchTranscriptionRequest | BatchTranslationRequest),
        ) -> (
            TranscriptionResponse
            | TranscriptionResponseVerbose
            | TranslationResponse
            | TranslationResponseVerbose
            | ErrorResponse
        ):
            try:
                # Download data from URL
                audio_data = await download_bytes_from_url(batch_request_body.file_url)

So the data flow is:

Attacker supplies JSON line in the batch input file with arbitrary body.file_url.
BatchRequestInput / BatchTranscriptionRequest / BatchTranslationRequest parse that JSON and store file_url verbatim.
make_transcription_wrapper calls download_bytes_from_url(batch_request_body.file_url).
download_bytes_from_url’s HTTP/HTTPS branch issues aiohttp.ClientSession().get(url) to that attacker-controlled URL with no further validation.

This is a classic SSRF pattern: a server-side component makes arbitrary HTTP requests to a URL string taken from untrusted input.

Comparison with safer code

The project already contains a safer URL-handling path for multimodal media in vllm/multimodal/media/connector.py, which demonstrates the intent to mitigate SSRF via domain allowlists and URL normalization:

# connector.py Lines 169-189
 def load_from_url(
        self,
        url: str,
        media_io: MediaIO[_M],
        *,
        fetch_timeout: int | None = None,
    ) -> _M:  # type: ignore[type-var]
        url_spec = parse_url(url)

        if url_spec.scheme and url_spec.scheme.startswith("http"):
            self._assert_url_in_allowed_media_domains(url_spec)

            connection = self.connection
            data = connection.get_bytes(
                url_spec.url,
                timeout=fetch_timeout,
                allow_redirects=envs.VLLM_MEDIA_URL_ALLOW_REDIRECTS,
            )

            return media_io.load_bytes(data)

and:

# connector.py Lines 158-167
  def _assert_url_in_allowed_media_domains(self, url_spec: Url) -> None:
        if (
            self.allowed_media_domains
            and url_spec.hostname not in self.allowed_media_domains
        ):
            raise ValueError(
                f"The URL must be from one of the allowed domains: "
                f"{self.allowed_media_domains}. Input URL domain: "
                f"{url_spec.hostname}"
            )

download_bytes_from_url does not reuse this allowlist or any equivalent validation, even though it also fetches user-provided URLs.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vllm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.16.0"
            },
            {
              "fixed": "0.19.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34753"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-03T21:51:00Z",
    "nvd_published_at": "2026-04-06T16:16:36Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nA Server Side Request Forgery (SSRF) vulnerability in `download_bytes_from_url` allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain restrictions.\n\nThis can be used to target internal services (e.g. cloud metadata endpoints or internal HTTP APIs) reachable from the vLLM host.\n\n------\n\n### Details\n\n#### Vulnerable component\n\nThe vulnerable logic is in the batch runner entrypoint `vllm/entrypoints/openai/run_batch.py`, function `download_bytes_from_url`:\n\n```\n# run_batch.py Lines 442-482\nasync def download_bytes_from_url(url: str) -\u003e bytes:\n    \"\"\"\n    Download data from a URL or decode from a data URL.\n\n    Args:\n        url: Either an HTTP/HTTPS URL or a data URL (data:...;base64,...)\n\n    Returns:\n        Data as bytes\n    \"\"\"\n    parsed = urlparse(url)\n\n    # Handle data URLs (base64 encoded)\n    if parsed.scheme == \"data\":\n        # Format: data:...;base64,\u003cbase64_data\u003e\n        if \",\" in url:\n            header, data = url.split(\",\", 1)\n            if \"base64\" in header:\n                return base64.b64decode(data)\n            else:\n                raise ValueError(f\"Unsupported data URL encoding: {header}\")\n        else:\n            raise ValueError(f\"Invalid data URL format: {url}\")\n\n    # Handle HTTP/HTTPS URLs\n    elif parsed.scheme in (\"http\", \"https\"):\n        async with (\n            aiohttp.ClientSession() as session,\n            session.get(url) as resp,\n        ):\n            if resp.status != 200:\n                raise Exception(\n                    f\"Failed to download data from URL: {url}. Status: {resp.status}\"\n                )\n            return await resp.read()\n\n    else:\n        raise ValueError(\n            f\"Unsupported URL scheme: {parsed.scheme}. \"\n            \"Supported schemes: http, https, data\"\n        )\n```\n\nKey properties:\n\n- The function only parses the URL to dispatch on the scheme (`data`, `http`, `https`).\n- For `http` / `https`, it directly calls `session.get(url)` on the provided string.\n- There is no validation of:\n  - hostname or IP address,\n  - whether the target is internal or external,\n  - port number,\n  - path, query, or redirect target.\n- This is in contrast to the multimodal media path (`MediaConnector`), which implements an explicit domain allowlist. `download_bytes_from_url` does not reuse that protection.\n\n#### URL controllability\n\nThe `url` argument is fully controlled by batch input JSON via the `file_url` field of `BatchTranscriptionRequest` / `BatchTranslationRequest`.\n\n1. Batch request body type:\n\n```\n# run_batch.py Line 67-80\nclass BatchTranscriptionRequest(TranscriptionRequest):\n    \"\"\"\n    Batch transcription request that uses file_url instead of file.\n\n    This class extends TranscriptionRequest but replaces the file field\n    with file_url to support batch processing from audio files written in JSON format.\n    \"\"\"\n\n    file_url: str = Field(\n        ...,\n        description=(\n            \"Either a URL of the audio or a data URL with base64 encoded audio data. \"\n        ),\n    )\n```\n\n```\n# run_batch.py Line 98-111\nclass BatchTranslationRequest(TranslationRequest):\n    \"\"\"\n    Batch translation request that uses file_url instead of file.\n\n    This class extends TranslationRequest but replaces the file field\n    with file_url to support batch processing from audio files written in JSON format.\n    \"\"\"\n\n    file_url: str = Field(\n        ...,\n        description=(\n            \"Either a URL of the audio or a data URL with base64 encoded audio data. \"\n        ),\n    )\n```\n\nThere is no restriction on the domain, IP, or port of `file_url` in these models.\n\n1. Batch input is parsed directly from the batch file:\n\n```\n# run_batch.py Line 139-179\nclass BatchRequestInput(OpenAIBaseModel):\n    ...\n    url: str\n    body: BatchRequestInputBody\n    @field_validator(\"body\", mode=\"plain\")\n    @classmethod\n    def check_type_for_url(cls, value: Any, info: ValidationInfo):\n        url: str = info.data[\"url\"]\n        ...\n        if url == \"/v1/audio/transcriptions\":\n            return BatchTranscriptionRequest.model_validate(value)\n        if url == \"/v1/audio/translations\":\n            return BatchTranslationRequest.model_validate(value)\n```\n\n```\n# run_batch.py Line 770-781\n   logger.info(\"Reading batch from %s...\", args.input_file)\n\n    # Submit all requests in the file to the engine \"concurrently\".\n    response_futures: list[Awaitable[BatchRequestOutput]] = []\n    for request_json in (await read_file(args.input_file)).strip().split(\"\\n\"):\n        # Skip empty lines.\n        request_json = request_json.strip()\n        if not request_json:\n            continue\n\n        request = BatchRequestInput.model_validate_json(request_json)\n```\n\nThe batch runner reads each line of the input file (`args.input_file`), parses it as JSON, and constructs a `BatchTranscriptionRequest` / `BatchTranslationRequest`. Whatever `file_url` appears in that JSON line becomes `batch_request_body.file_url`.\n\n1. `file_url` is passed directly into `download_bytes_from_url`:\n\n```\n# run_batch.py Line 610-623\ndef wrapper(handler_fn: Callable):\n        async def transcription_wrapper(\n            batch_request_body: (BatchTranscriptionRequest | BatchTranslationRequest),\n        ) -\u003e (\n            TranscriptionResponse\n            | TranscriptionResponseVerbose\n            | TranslationResponse\n            | TranslationResponseVerbose\n            | ErrorResponse\n        ):\n            try:\n                # Download data from URL\n                audio_data = await download_bytes_from_url(batch_request_body.file_url)\n```\n\nSo the data flow is:\n\n1. Attacker supplies JSON line in the batch input file with arbitrary `body.file_url`.\n2. `BatchRequestInput` / `BatchTranscriptionRequest` / `BatchTranslationRequest` parse that JSON and store `file_url` verbatim.\n3. `make_transcription_wrapper` calls `download_bytes_from_url(batch_request_body.file_url)`.\n4. `download_bytes_from_url`\u2019s HTTP/HTTPS branch issues `aiohttp.ClientSession().get(url)` to that attacker-controlled URL with no further validation.\n\nThis is a classic SSRF pattern: a server-side component makes arbitrary HTTP requests to a URL string taken from untrusted input.\n\n#### Comparison with safer code\n\nThe project already contains a safer URL-handling path for multimodal media in `vllm/multimodal/media/connector.py`, which demonstrates the intent to mitigate SSRF via domain allowlists and URL normalization:\n\n```\n# connector.py Lines 169-189\n def load_from_url(\n        self,\n        url: str,\n        media_io: MediaIO[_M],\n        *,\n        fetch_timeout: int | None = None,\n    ) -\u003e _M:  # type: ignore[type-var]\n        url_spec = parse_url(url)\n\n        if url_spec.scheme and url_spec.scheme.startswith(\"http\"):\n            self._assert_url_in_allowed_media_domains(url_spec)\n\n            connection = self.connection\n            data = connection.get_bytes(\n                url_spec.url,\n                timeout=fetch_timeout,\n                allow_redirects=envs.VLLM_MEDIA_URL_ALLOW_REDIRECTS,\n            )\n\n            return media_io.load_bytes(data)\n```\n\nand:\n\n```\n# connector.py Lines 158-167\n  def _assert_url_in_allowed_media_domains(self, url_spec: Url) -\u003e None:\n        if (\n            self.allowed_media_domains\n            and url_spec.hostname not in self.allowed_media_domains\n        ):\n            raise ValueError(\n                f\"The URL must be from one of the allowed domains: \"\n                f\"{self.allowed_media_domains}. Input URL domain: \"\n                f\"{url_spec.hostname}\"\n            )\n```\n\n`download_bytes_from_url` does not reuse this allowlist or any equivalent validation, even though it also fetches user-provided URLs.",
  "id": "GHSA-pf3h-qjgv-vcpr",
  "modified": "2026-07-17T16:18:19Z",
  "published": "2026-04-03T21:51:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34753"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/pull/38482"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/commit/57861ae48d3493fa48b4d7d830b7ec9f995783e7"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-pf3h-qjgv-vcpr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-3410.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vllm-project/vllm"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/vllm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `"
}

PYSEC-2026-3410

Vulnerability from pysec - Published: 2026-07-13 14:36 - Updated: 2026-07-13 16:07

Details

Summary

A Server Side Request Forgery (SSRF) vulnerability in download_bytes_from_url allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain restrictions.

This can be used to target internal services (e.g. cloud metadata endpoints or internal HTTP APIs) reachable from the vLLM host.

Details

Vulnerable component

The vulnerable logic is in the batch runner entrypoint vllm/entrypoints/openai/run_batch.py, function download_bytes_from_url:

# run_batch.py Lines 442-482
async def download_bytes_from_url(url: str) -> bytes:
    """
    Download data from a URL or decode from a data URL.

    Args:
        url: Either an HTTP/HTTPS URL or a data URL (data:...;base64,...)

    Returns:
        Data as bytes
    """
    parsed = urlparse(url)

    # Handle data URLs (base64 encoded)
    if parsed.scheme == "data":
        # Format: data:...;base64,<base64_data>
        if "," in url:
            header, data = url.split(",", 1)
            if "base64" in header:
                return base64.b64decode(data)
            else:
                raise ValueError(f"Unsupported data URL encoding: {header}")
        else:
            raise ValueError(f"Invalid data URL format: {url}")

    # Handle HTTP/HTTPS URLs
    elif parsed.scheme in ("http", "https"):
        async with (
            aiohttp.ClientSession() as session,
            session.get(url) as resp,
        ):
            if resp.status != 200:
                raise Exception(
                    f"Failed to download data from URL: {url}. Status: {resp.status}"
                )
            return await resp.read()

    else:
        raise ValueError(
            f"Unsupported URL scheme: {parsed.scheme}. "
            "Supported schemes: http, https, data"
        )

Key properties:

The function only parses the URL to dispatch on the scheme (data, http, https).
For http / https, it directly calls session.get(url) on the provided string.
There is no validation of:
hostname or IP address,
whether the target is internal or external,
port number,
path, query, or redirect target.
This is in contrast to the multimodal media path (MediaConnector), which implements an explicit domain allowlist. download_bytes_from_url does not reuse that protection.

URL controllability

The url argument is fully controlled by batch input JSON via the file_url field of BatchTranscriptionRequest / BatchTranslationRequest.

Batch request body type:

# run_batch.py Line 67-80
class BatchTranscriptionRequest(TranscriptionRequest):
    """
    Batch transcription request that uses file_url instead of file.

    This class extends TranscriptionRequest but replaces the file field
    with file_url to support batch processing from audio files written in JSON format.
    """

    file_url: str = Field(
        ...,
        description=(
            "Either a URL of the audio or a data URL with base64 encoded audio data. "
        ),
    )

# run_batch.py Line 98-111
class BatchTranslationRequest(TranslationRequest):
    """
    Batch translation request that uses file_url instead of file.

    This class extends TranslationRequest but replaces the file field
    with file_url to support batch processing from audio files written in JSON format.
    """

    file_url: str = Field(
        ...,
        description=(
            "Either a URL of the audio or a data URL with base64 encoded audio data. "
        ),
    )

There is no restriction on the domain, IP, or port of file_url in these models.

Batch input is parsed directly from the batch file:

# run_batch.py Line 139-179
class BatchRequestInput(OpenAIBaseModel):
    ...
    url: str
    body: BatchRequestInputBody
    @field_validator("body", mode="plain")
    @classmethod
    def check_type_for_url(cls, value: Any, info: ValidationInfo):
        url: str = info.data["url"]
        ...
        if url == "/v1/audio/transcriptions":
            return BatchTranscriptionRequest.model_validate(value)
        if url == "/v1/audio/translations":
            return BatchTranslationRequest.model_validate(value)

# run_batch.py Line 770-781
   logger.info("Reading batch from %s...", args.input_file)

    # Submit all requests in the file to the engine "concurrently".
    response_futures: list[Awaitable[BatchRequestOutput]] = []
    for request_json in (await read_file(args.input_file)).strip().split("\n"):
        # Skip empty lines.
        request_json = request_json.strip()
        if not request_json:
            continue

        request = BatchRequestInput.model_validate_json(request_json)

The batch runner reads each line of the input file (args.input_file), parses it as JSON, and constructs a BatchTranscriptionRequest / BatchTranslationRequest. Whatever file_url appears in that JSON line becomes batch_request_body.file_url.

file_url is passed directly into download_bytes_from_url:

# run_batch.py Line 610-623
def wrapper(handler_fn: Callable):
        async def transcription_wrapper(
            batch_request_body: (BatchTranscriptionRequest | BatchTranslationRequest),
        ) -> (
            TranscriptionResponse
            | TranscriptionResponseVerbose
            | TranslationResponse
            | TranslationResponseVerbose
            | ErrorResponse
        ):
            try:
                # Download data from URL
                audio_data = await download_bytes_from_url(batch_request_body.file_url)

So the data flow is:

Attacker supplies JSON line in the batch input file with arbitrary body.file_url.
BatchRequestInput / BatchTranscriptionRequest / BatchTranslationRequest parse that JSON and store file_url verbatim.
make_transcription_wrapper calls download_bytes_from_url(batch_request_body.file_url).
download_bytes_from_url’s HTTP/HTTPS branch issues aiohttp.ClientSession().get(url) to that attacker-controlled URL with no further validation.

This is a classic SSRF pattern: a server-side component makes arbitrary HTTP requests to a URL string taken from untrusted input.

Comparison with safer code

The project already contains a safer URL-handling path for multimodal media in vllm/multimodal/media/connector.py, which demonstrates the intent to mitigate SSRF via domain allowlists and URL normalization:

# connector.py Lines 169-189
 def load_from_url(
        self,
        url: str,
        media_io: MediaIO[_M],
        *,
        fetch_timeout: int | None = None,
    ) -> _M:  # type: ignore[type-var]
        url_spec = parse_url(url)

        if url_spec.scheme and url_spec.scheme.startswith("http"):
            self._assert_url_in_allowed_media_domains(url_spec)

            connection = self.connection
            data = connection.get_bytes(
                url_spec.url,
                timeout=fetch_timeout,
                allow_redirects=envs.VLLM_MEDIA_URL_ALLOW_REDIRECTS,
            )

            return media_io.load_bytes(data)

and:

# connector.py Lines 158-167
  def _assert_url_in_allowed_media_domains(self, url_spec: Url) -> None:
        if (
            self.allowed_media_domains
            and url_spec.hostname not in self.allowed_media_domains
        ):
            raise ValueError(
                f"The URL must be from one of the allowed domains: "
                f"{self.allowed_media_domains}. Input URL domain: "
                f"{url_spec.hostname}"
            )

download_bytes_from_url does not reuse this allowlist or any equivalent validation, even though it also fetches user-provided URLs.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Impacted products

Name	purl
vllm	pkg:pypi/vllm

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vllm",
        "purl": "pkg:pypi/vllm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.16.0"
            },
            {
              "fixed": "0.19.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.16.0",
        "0.17.0",
        "0.17.1",
        "0.18.0",
        "0.18.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34753",
    "GHSA-pf3h-qjgv-vcpr"
  ],
  "details": "### Summary\n\nA Server Side Request Forgery (SSRF) vulnerability in `download_bytes_from_url` allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain restrictions.\n\nThis can be used to target internal services (e.g. cloud metadata endpoints or internal HTTP APIs) reachable from the vLLM host.\n\n------\n\n### Details\n\n#### Vulnerable component\n\nThe vulnerable logic is in the batch runner entrypoint `vllm/entrypoints/openai/run_batch.py`, function `download_bytes_from_url`:\n\n```\n# run_batch.py Lines 442-482\nasync def download_bytes_from_url(url: str) -\u003e bytes:\n    \"\"\"\n    Download data from a URL or decode from a data URL.\n\n    Args:\n        url: Either an HTTP/HTTPS URL or a data URL (data:...;base64,...)\n\n    Returns:\n        Data as bytes\n    \"\"\"\n    parsed = urlparse(url)\n\n    # Handle data URLs (base64 encoded)\n    if parsed.scheme == \"data\":\n        # Format: data:...;base64,\u003cbase64_data\u003e\n        if \",\" in url:\n            header, data = url.split(\",\", 1)\n            if \"base64\" in header:\n                return base64.b64decode(data)\n            else:\n                raise ValueError(f\"Unsupported data URL encoding: {header}\")\n        else:\n            raise ValueError(f\"Invalid data URL format: {url}\")\n\n    # Handle HTTP/HTTPS URLs\n    elif parsed.scheme in (\"http\", \"https\"):\n        async with (\n            aiohttp.ClientSession() as session,\n            session.get(url) as resp,\n        ):\n            if resp.status != 200:\n                raise Exception(\n                    f\"Failed to download data from URL: {url}. Status: {resp.status}\"\n                )\n            return await resp.read()\n\n    else:\n        raise ValueError(\n            f\"Unsupported URL scheme: {parsed.scheme}. \"\n            \"Supported schemes: http, https, data\"\n        )\n```\n\nKey properties:\n\n- The function only parses the URL to dispatch on the scheme (`data`, `http`, `https`).\n- For `http` / `https`, it directly calls `session.get(url)` on the provided string.\n- There is no validation of:\n  - hostname or IP address,\n  - whether the target is internal or external,\n  - port number,\n  - path, query, or redirect target.\n- This is in contrast to the multimodal media path (`MediaConnector`), which implements an explicit domain allowlist. `download_bytes_from_url` does not reuse that protection.\n\n#### URL controllability\n\nThe `url` argument is fully controlled by batch input JSON via the `file_url` field of `BatchTranscriptionRequest` / `BatchTranslationRequest`.\n\n1. Batch request body type:\n\n```\n# run_batch.py Line 67-80\nclass BatchTranscriptionRequest(TranscriptionRequest):\n    \"\"\"\n    Batch transcription request that uses file_url instead of file.\n\n    This class extends TranscriptionRequest but replaces the file field\n    with file_url to support batch processing from audio files written in JSON format.\n    \"\"\"\n\n    file_url: str = Field(\n        ...,\n        description=(\n            \"Either a URL of the audio or a data URL with base64 encoded audio data. \"\n        ),\n    )\n```\n\n```\n# run_batch.py Line 98-111\nclass BatchTranslationRequest(TranslationRequest):\n    \"\"\"\n    Batch translation request that uses file_url instead of file.\n\n    This class extends TranslationRequest but replaces the file field\n    with file_url to support batch processing from audio files written in JSON format.\n    \"\"\"\n\n    file_url: str = Field(\n        ...,\n        description=(\n            \"Either a URL of the audio or a data URL with base64 encoded audio data. \"\n        ),\n    )\n```\n\nThere is no restriction on the domain, IP, or port of `file_url` in these models.\n\n1. Batch input is parsed directly from the batch file:\n\n```\n# run_batch.py Line 139-179\nclass BatchRequestInput(OpenAIBaseModel):\n    ...\n    url: str\n    body: BatchRequestInputBody\n    @field_validator(\"body\", mode=\"plain\")\n    @classmethod\n    def check_type_for_url(cls, value: Any, info: ValidationInfo):\n        url: str = info.data[\"url\"]\n        ...\n        if url == \"/v1/audio/transcriptions\":\n            return BatchTranscriptionRequest.model_validate(value)\n        if url == \"/v1/audio/translations\":\n            return BatchTranslationRequest.model_validate(value)\n```\n\n```\n# run_batch.py Line 770-781\n   logger.info(\"Reading batch from %s...\", args.input_file)\n\n    # Submit all requests in the file to the engine \"concurrently\".\n    response_futures: list[Awaitable[BatchRequestOutput]] = []\n    for request_json in (await read_file(args.input_file)).strip().split(\"\\n\"):\n        # Skip empty lines.\n        request_json = request_json.strip()\n        if not request_json:\n            continue\n\n        request = BatchRequestInput.model_validate_json(request_json)\n```\n\nThe batch runner reads each line of the input file (`args.input_file`), parses it as JSON, and constructs a `BatchTranscriptionRequest` / `BatchTranslationRequest`. Whatever `file_url` appears in that JSON line becomes `batch_request_body.file_url`.\n\n1. `file_url` is passed directly into `download_bytes_from_url`:\n\n```\n# run_batch.py Line 610-623\ndef wrapper(handler_fn: Callable):\n        async def transcription_wrapper(\n            batch_request_body: (BatchTranscriptionRequest | BatchTranslationRequest),\n        ) -\u003e (\n            TranscriptionResponse\n            | TranscriptionResponseVerbose\n            | TranslationResponse\n            | TranslationResponseVerbose\n            | ErrorResponse\n        ):\n            try:\n                # Download data from URL\n                audio_data = await download_bytes_from_url(batch_request_body.file_url)\n```\n\nSo the data flow is:\n\n1. Attacker supplies JSON line in the batch input file with arbitrary `body.file_url`.\n2. `BatchRequestInput` / `BatchTranscriptionRequest` / `BatchTranslationRequest` parse that JSON and store `file_url` verbatim.\n3. `make_transcription_wrapper` calls `download_bytes_from_url(batch_request_body.file_url)`.\n4. `download_bytes_from_url`\u2019s HTTP/HTTPS branch issues `aiohttp.ClientSession().get(url)` to that attacker-controlled URL with no further validation.\n\nThis is a classic SSRF pattern: a server-side component makes arbitrary HTTP requests to a URL string taken from untrusted input.\n\n#### Comparison with safer code\n\nThe project already contains a safer URL-handling path for multimodal media in `vllm/multimodal/media/connector.py`, which demonstrates the intent to mitigate SSRF via domain allowlists and URL normalization:\n\n```\n# connector.py Lines 169-189\n def load_from_url(\n        self,\n        url: str,\n        media_io: MediaIO[_M],\n        *,\n        fetch_timeout: int | None = None,\n    ) -\u003e _M:  # type: ignore[type-var]\n        url_spec = parse_url(url)\n\n        if url_spec.scheme and url_spec.scheme.startswith(\"http\"):\n            self._assert_url_in_allowed_media_domains(url_spec)\n\n            connection = self.connection\n            data = connection.get_bytes(\n                url_spec.url,\n                timeout=fetch_timeout,\n                allow_redirects=envs.VLLM_MEDIA_URL_ALLOW_REDIRECTS,\n            )\n\n            return media_io.load_bytes(data)\n```\n\nand:\n\n```\n# connector.py Lines 158-167\n  def _assert_url_in_allowed_media_domains(self, url_spec: Url) -\u003e None:\n        if (\n            self.allowed_media_domains\n            and url_spec.hostname not in self.allowed_media_domains\n        ):\n            raise ValueError(\n                f\"The URL must be from one of the allowed domains: \"\n                f\"{self.allowed_media_domains}. Input URL domain: \"\n                f\"{url_spec.hostname}\"\n            )\n```\n\n`download_bytes_from_url` does not reuse this allowlist or any equivalent validation, even though it also fetches user-provided URLs.",
  "id": "PYSEC-2026-3410",
  "modified": "2026-07-13T16:07:26.344587Z",
  "published": "2026-07-13T14:36:47.649954Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34753"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/pull/38482"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/commit/57861ae48d3493fa48b4d7d830b7ec9f995783e7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vllm-project/vllm"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/vllm"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-pf3h-qjgv-vcpr"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `"
}

RHSA-2026:57380

Vulnerability from csaf_redhat - Published: 2026-08-20 07:55 - Updated: 2026-08-23 19:03

Summary

Red Hat Security Advisory: Red Hat AI Inference 3.4.4 (cpu)

Severity

Important

Notes

Topic: Red Hat AI Inference 3.4.4 (cpu) is now available.

Details: Red Hat AI Inference

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-34753

A flaw was found in vLLM. This server-side request forgery (SSRF) vulnerability allows an attacker who can control batch input JSON to force the vLLM batch runner to make arbitrary HTTP/HTTPS requests from the server. This can be exploited to access internal services, such as cloud metadata endpoints or internal HTTP APIs, potentially leading to information disclosure or further compromise of the host system.

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

CWE-918 - Server-Side Request Forgery (SSRF)

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64		—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-34755

A flaw was found in vLLM, an inference and serving engine for large language models. A remote attacker can exploit a vulnerability in the VideoMediaIO.load_base64() method by sending a single API request containing a large number of comma-separated base64-encoded JPEG frames. This bypasses the intended frame count limit, causing the server to decode all frames into memory. This can lead to an Out-of-Memory (OOM) crash, resulting in a Denial of Service (DoS) for the affected system.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64		—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-34756

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large 'n' parameter to the vLLM OpenAI-compatible API server. This can lead to a Denial of Service (DoS) by consuming excessive memory and blocking the system's event loop, causing the server to crash.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-1284 - Improper Validation of Specified Quantity in Input

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64		—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-41523

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit an assert-based security check during activation function loading. By publishing a malicious HuggingFace model, an attacker can achieve arbitrary code execution on the server when vLLM runs in Python optimized mode.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64		—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-44223

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). The extract_hidden_states speculative decoding proposer returns a tensor with an incorrect shape after the first decode step. This can be triggered by a remote attacker sending a request that uses sampling penalty parameters, such as repetition_penalty, frequency_penalty, or presence_penalty. Successful exploitation leads to a RuntimeError that crashes the EngineCore process, resulting in a denial of service (DoS).

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-130 - Improper Handling of Length Parameter Inconsistency

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64		—	Vendor Fix fix Workaround

Threats

Impact Important

References

39 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:57380	self
https://access.redhat.com/security/cve/CVE-2026-34753	external
https://access.redhat.com/security/cve/CVE-2026-34755	external
https://access.redhat.com/security/cve/CVE-2026-34756	external
https://access.redhat.com/security/cve/CVE-2026-41523	external
https://access.redhat.com/security/cve/CVE-2026-44223	external
https://access.redhat.com/security/updates/classi…	external
https://www.redhat.com/en/products/ai/inference-server	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-34753	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455394	external
https://www.cve.org/CVERecord?id=CVE-2026-34753	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34753	external
https://github.com/vllm-project/vllm/security/adv…	external
https://access.redhat.com/security/cve/CVE-2026-34755	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455403	external
https://www.cve.org/CVERecord?id=CVE-2026-34755	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34755	external
https://github.com/vllm-project/vllm/security/adv…	external
https://access.redhat.com/security/cve/CVE-2026-34756	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455425	external
https://www.cve.org/CVERecord?id=CVE-2026-34756	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34756	external
https://github.com/vllm-project/vllm/commit/b111f…	external
https://github.com/vllm-project/vllm/pull/37952	external
https://github.com/vllm-project/vllm/security/adv…	external
https://access.redhat.com/security/cve/CVE-2026-41523	self
https://bugzilla.redhat.com/show_bug.cgi?id=2491582	external
https://www.cve.org/CVERecord?id=CVE-2026-41523	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41523	external
https://github.com/vllm-project/vllm/commit/b3c7f…	external
https://github.com/vllm-project/vllm/security/adv…	external
https://huntr.com/bounties/dcb05b04-e625-41e7-adb…	external
https://access.redhat.com/security/cve/CVE-2026-44223	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476827	external
https://www.cve.org/CVERecord?id=CVE-2026-44223	external
https://nvd.nist.gov/vuln/detail/CVE-2026-44223	external
https://github.com/vllm-project/vllm/pull/38610	external
https://github.com/vllm-project/vllm/security/adv…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AI Inference 3.4.4 (cpu) is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat AI Inference",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:57380",
        "url": "https://access.redhat.com/errata/RHSA-2026:57380"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34753",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34753"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34755",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34755"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34756",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34756"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41523",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41523"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44223",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44223"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://www.redhat.com/en/products/ai/inference-server",
        "url": "https://www.redhat.com/en/products/ai/inference-server"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57380.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AI Inference 3.4.4 (cpu)",
    "tracking": {
      "current_release_date": "2026-08-23T19:03:50+00:00",
      "generator": {
        "date": "2026-08-23T19:03:50+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:57380",
      "initial_release_date": "2026-08-20T07:55:41+00:00",
      "revision_history": [
        {
          "date": "2026-08-20T07:55:41+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T06:15:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-23T19:03:50+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat AI Inference Server 3.4",
                "product": {
                  "name": "Red Hat AI Inference Server 3.4",
                  "product_id": "Red Hat AI Inference Server 3.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ai_inference_server:3.4::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat AI Inference Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64",
                "product": {
                  "name": "registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64",
                  "product_id": "registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vllm-cpu-rhel9@sha256%3A2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f?arch=amd64\u0026repository_url=registry.redhat.io/rhaii/vllm-cpu-rhel9\u0026tag=1787151769"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64 as a component of Red Hat AI Inference Server 3.4",
          "product_id": "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
        },
        "product_reference": "registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-34753",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2026-04-06T16:01:43.723837+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455394"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM. This server-side request forgery (SSRF) vulnerability allows an attacker who can control batch input JSON to force the vLLM batch runner to make arbitrary HTTP/HTTPS requests from the server. This can be exploited to access internal services, such as cloud metadata endpoints or internal HTTP APIs, potentially leading to information disclosure or further compromise of the host system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Server-Side Request Forgery allows access to internal services via controlled batch input",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34753"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455394",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455394"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34753",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34753"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34753",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34753"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr"
        }
      ],
      "release_date": "2026-04-06T15:36:52.942000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:55:41+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57380",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57380"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vllm: vLLM: Server-Side Request Forgery allows access to internal services via controlled batch input"
    },
    {
      "cve": "CVE-2026-34755",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-06T16:02:21.718949+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455403"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models. A remote attacker can exploit a vulnerability in the VideoMediaIO.load_base64() method by sending a single API request containing a large number of comma-separated base64-encoded JPEG frames. This bypasses the intended frame count limit, causing the server to decode all frames into memory. This can lead to an Out-of-Memory (OOM) crash, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vLLM: vLLM: Denial of Service due to excessive video frame processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34755"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455403",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455403"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34755",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34755"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34755",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34755"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p"
        }
      ],
      "release_date": "2026-04-06T15:38:53.201000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:55:41+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57380",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57380"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vLLM: vLLM: Denial of Service due to excessive video frame processing"
    },
    {
      "cve": "CVE-2026-34756",
      "cwe": {
        "id": "CWE-1284",
        "name": "Improper Validation of Specified Quantity in Input"
      },
      "discovery_date": "2026-04-06T16:03:45.222577+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455425"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large \u0027n\u0027 parameter to the vLLM OpenAI-compatible API server. This can lead to a Denial of Service (DoS) by consuming excessive memory and blocking the system\u0027s event loop, causing the server to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Denial of Service via excessively large \u0027n\u0027 parameter in OpenAI-compatible API",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34756"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455425",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455425"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34756",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34756"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34756",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34756"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/commit/b111f8a61f100fdca08706f41f29ef3548de7380",
          "url": "https://github.com/vllm-project/vllm/commit/b111f8a61f100fdca08706f41f29ef3548de7380"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/pull/37952",
          "url": "https://github.com/vllm-project/vllm/pull/37952"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-3mwp-wvh9-7528",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-3mwp-wvh9-7528"
        }
      ],
      "release_date": "2026-04-06T15:40:03.448000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:55:41+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57380",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57380"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vllm: vLLM: Denial of Service via excessively large \u0027n\u0027 parameter in OpenAI-compatible API"
    },
    {
      "cve": "CVE-2026-41523",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-06-22T23:01:00.799590+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491582"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit an assert-based security check during activation function loading. By publishing a malicious HuggingFace model, an attacker can achieve arbitrary code execution on the server when vLLM runs in Python optimized mode.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Arbitrary code execution via malicious HuggingFace model",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this issue as having Important impact for Red Hat AI Inference Server and Red Hat OpenShift AI vLLM serving images, and Moderate impact for Red Hat Enterprise Linux AI bootc images that bundle vLLM. Exploitation requires loading an untrusted HuggingFace cross-encoder model while the vLLM process runs with Python optimized mode (python -O or PYTHONOPTIMIZE=1). Red Hat AI Inference Server 3.2/3.3 images and other components without the vulnerable pooler activation loader (vLLM \u003c 0.14.0) are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41523"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491582",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491582"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41523",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41523"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41523",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41523"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3",
          "url": "https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r"
        },
        {
          "category": "external",
          "summary": "https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c",
          "url": "https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c"
        }
      ],
      "release_date": "2026-06-22T22:18:14.494000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:55:41+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57380",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57380"
        },
        {
          "category": "workaround",
          "details": "Avoid running vLLM with python -O or PYTHONOPTIMIZE=1 until updated packages are available. Only load models from trusted sources. Restrict who can deploy or update models on inference endpoints. Apply network access controls and authentication in front of vLLM APIs.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vllm: vLLM: Arbitrary code execution via malicious HuggingFace model"
    },
    {
      "cve": "CVE-2026-44223",
      "cwe": {
        "id": "CWE-130",
        "name": "Improper Handling of Length Parameter Inconsistency"
      },
      "discovery_date": "2026-05-12T21:02:06.713372+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). The extract_hidden_states speculative decoding proposer returns a tensor with an incorrect shape after the first decode step. This can be triggered by a remote attacker sending a request that uses sampling penalty parameters, such as repetition_penalty, frequency_penalty, or presence_penalty. Successful exploitation leads to a RuntimeError that crashes the EngineCore process, resulting in a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Denial of Service via malformed tensor shape in speculative decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in vLLM, as used in Red Hat AI Inference Server and Red Hat OpenShift AI, allows a remote attacker to crash the EngineCore process. By sending a request with specific sampling penalty parameters, an attacker can trigger an incorrect tensor shape, leading to a service disruption for affected AI inference workloads.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44223"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44223",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44223"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44223",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44223"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/pull/38610",
          "url": "https://github.com/vllm-project/vllm/pull/38610"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-83vm-p52w-f9pw",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-83vm-p52w-f9pw"
        }
      ],
      "release_date": "2026-05-12T19:58:40.862000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:55:41+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57380",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57380"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:2e9fee8758cfe000f5b304c3de525fc812433fc2ad39122de86140f36c7be04f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vllm: vLLM: Denial of Service via malformed tensor shape in speculative decoding"
    }
  ]
}

RHSA-2026:57387

Vulnerability from csaf_redhat - Published: 2026-08-20 07:57 - Updated: 2026-08-23 19:03

Summary

Red Hat Security Advisory: Red Hat AI Inference 3.4.4 (spyre)

Severity

Important

Notes

Topic: Red Hat AI Inference 3.4.4 (spyre) is now available.

Details: Red Hat AI Inference

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-34753

A flaw was found in vLLM. This server-side request forgery (SSRF) vulnerability allows an attacker who can control batch input JSON to force the vLLM batch runner to make arbitrary HTTP/HTTPS requests from the server. This can be exploited to access internal services, such as cloud metadata endpoints or internal HTTP APIs, potentially leading to information disclosure or further compromise of the host system.

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

CWE-918 - Server-Side Request Forgery (SSRF)

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-34755

A flaw was found in vLLM, an inference and serving engine for large language models. A remote attacker can exploit a vulnerability in the VideoMediaIO.load_base64() method by sending a single API request containing a large number of comma-separated base64-encoded JPEG frames. This bypasses the intended frame count limit, causing the server to decode all frames into memory. This can lead to an Out-of-Memory (OOM) crash, resulting in a Denial of Service (DoS) for the affected system.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-34756

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large 'n' parameter to the vLLM OpenAI-compatible API server. This can lead to a Denial of Service (DoS) by consuming excessive memory and blocking the system's event loop, causing the server to crash.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-1284 - Improper Validation of Specified Quantity in Input

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-40192

A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to trigger a denial of service (DoS) by providing a specially crafted FITS image file. The library's failure to limit the amount of GZIP-compressed data during decoding can lead to unbounded memory consumption, causing the system to crash or experience severe performance issues.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-41523

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit an assert-based security check during activation function loading. By publishing a malicious HuggingFace model, an attacker can achieve arbitrary code execution on the server when vLLM runs in Python optimized mode.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-42308

A flaw was found in Pillow, a Python imaging library. If a font advances for each glyph by an exceeding large amount, an integer overflow can occur when Pillow tracks the current position. This could lead to a denial of service (DoS) condition, making the application unavailable.

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-42309

A flaw was found in Pillow, a Python imaging library. A malicious actor could exploit this vulnerability by providing specially crafted nested lists as coordinates to image processing APIs within Pillow. This could lead to a heap buffer overflow, potentially causing a denial of service in applications using the library.

5.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-131 - Incorrect Calculation of Buffer Size

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x	—	Vendor Fix fix
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-42310

A flaw was found in Pillow, a Python imaging library. A remote attacker could supply a specially crafted malicious PDF file, causing the application to hang indefinitely and consume 100% CPU. This vulnerability leads to a Denial of Service (DoS), making the application unresponsive.

4.0 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x	—	Vendor Fix fix
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-42311

A flaw was found in Pillow, a Python imaging library. An attacker could exploit this vulnerability by tricking a user into processing a specially crafted malicious PSD file. This could lead to memory corruption, potentially causing the application to crash or allowing for arbitrary code execution.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-44223

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). The extract_hidden_states speculative decoding proposer returns a tensor with an incorrect shape after the first decode step. This can be triggered by a remote attacker sending a request that uses sampling penalty parameters, such as repetition_penalty, frequency_penalty, or presence_penalty. Successful exploitation leads to a RuntimeError that crashes the EngineCore process, resulting in a denial of service (DoS).

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-130 - Improper Handling of Length Parameter Inconsistency

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le	—	Vendor Fix fix Workaround

Threats

Impact Important

References

77 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:57387	self
https://access.redhat.com/security/cve/CVE-2026-34753	external
https://access.redhat.com/security/cve/CVE-2026-34755	external
https://access.redhat.com/security/cve/CVE-2026-34756	external
https://access.redhat.com/security/cve/CVE-2026-40192	external
https://access.redhat.com/security/cve/CVE-2026-41523	external
https://access.redhat.com/security/cve/CVE-2026-42308	external
https://access.redhat.com/security/cve/CVE-2026-42309	external
https://access.redhat.com/security/cve/CVE-2026-42310	external
https://access.redhat.com/security/cve/CVE-2026-42311	external
https://access.redhat.com/security/cve/CVE-2026-44223	external
https://access.redhat.com/security/updates/classi…	external
https://www.redhat.com/en/products/ai/inference-server	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-34753	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455394	external
https://www.cve.org/CVERecord?id=CVE-2026-34753	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34753	external
https://github.com/vllm-project/vllm/security/adv…	external
https://access.redhat.com/security/cve/CVE-2026-34755	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455403	external
https://www.cve.org/CVERecord?id=CVE-2026-34755	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34755	external
https://github.com/vllm-project/vllm/security/adv…	external
https://access.redhat.com/security/cve/CVE-2026-34756	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455425	external
https://www.cve.org/CVERecord?id=CVE-2026-34756	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34756	external
https://github.com/vllm-project/vllm/commit/b111f…	external
https://github.com/vllm-project/vllm/pull/37952	external
https://github.com/vllm-project/vllm/security/adv…	external
https://access.redhat.com/security/cve/CVE-2026-40192	self
https://bugzilla.redhat.com/show_bug.cgi?id=2458856	external
https://www.cve.org/CVERecord?id=CVE-2026-40192	external
https://nvd.nist.gov/vuln/detail/CVE-2026-40192	external
https://github.com/python-pillow/Pillow/commit/3c…	external
https://github.com/python-pillow/Pillow/pull/9521	external
https://github.com/python-pillow/Pillow/security/…	external
https://pillow.readthedocs.io/en/stable/releaseno…	external
https://access.redhat.com/security/cve/CVE-2026-41523	self
https://bugzilla.redhat.com/show_bug.cgi?id=2491582	external
https://www.cve.org/CVERecord?id=CVE-2026-41523	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41523	external
https://github.com/vllm-project/vllm/commit/b3c7f…	external
https://github.com/vllm-project/vllm/security/adv…	external
https://huntr.com/bounties/dcb05b04-e625-41e7-adb…	external
https://access.redhat.com/security/cve/CVE-2026-42308	self
https://bugzilla.redhat.com/show_bug.cgi?id=2468457	external
https://www.cve.org/CVERecord?id=CVE-2026-42308	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42308	external
https://github.com/python-pillow/Pillow/releases/…	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-42309	self
https://bugzilla.redhat.com/show_bug.cgi?id=2468458	external
https://www.cve.org/CVERecord?id=CVE-2026-42309	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42309	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-42310	self
https://bugzilla.redhat.com/show_bug.cgi?id=2468461	external
https://www.cve.org/CVERecord?id=CVE-2026-42310	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42310	external
https://github.com/python-pillow/Pillow/commit/3b…	external
https://github.com/python-pillow/Pillow/pull/9519	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-42311	self
https://bugzilla.redhat.com/show_bug.cgi?id=2468459	external
https://www.cve.org/CVERecord?id=CVE-2026-42311	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42311	external
https://github.com/python-pillow/Pillow/commit/58…	external
https://github.com/python-pillow/Pillow/pull/9520	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-44223	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476827	external
https://www.cve.org/CVERecord?id=CVE-2026-44223	external
https://nvd.nist.gov/vuln/detail/CVE-2026-44223	external
https://github.com/vllm-project/vllm/pull/38610	external
https://github.com/vllm-project/vllm/security/adv…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AI Inference 3.4.4 (spyre) is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat AI Inference",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:57387",
        "url": "https://access.redhat.com/errata/RHSA-2026:57387"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34753",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34753"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34755",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34755"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34756",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34756"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-40192",
        "url": "https://access.redhat.com/security/cve/CVE-2026-40192"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41523",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41523"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42308",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42308"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42309",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42309"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42310",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42310"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42311",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42311"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44223",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44223"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://www.redhat.com/en/products/ai/inference-server",
        "url": "https://www.redhat.com/en/products/ai/inference-server"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57387.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AI Inference 3.4.4 (spyre)",
    "tracking": {
      "current_release_date": "2026-08-23T19:03:28+00:00",
      "generator": {
        "date": "2026-08-23T19:03:28+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:57387",
      "initial_release_date": "2026-08-20T07:57:23+00:00",
      "revision_history": [
        {
          "date": "2026-08-20T07:57:23+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T06:15:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-23T19:03:28+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat AI Inference Server 3.4",
                "product": {
                  "name": "Red Hat AI Inference Server 3.4",
                  "product_id": "Red Hat AI Inference Server 3.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ai_inference_server:3.4::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat AI Inference Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le",
                  "product_id": "registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vllm-spyre-rhel9@sha256%3Ab35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09?arch=ppc64le\u0026repository_url=registry.redhat.io/rhaii/vllm-spyre-rhel9\u0026tag=1787151840"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
                "product": {
                  "name": "registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
                  "product_id": "registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vllm-spyre-rhel9@sha256%3A3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41?arch=s390x\u0026repository_url=registry.redhat.io/rhaii/vllm-spyre-rhel9\u0026tag=1787151840"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
                "product": {
                  "name": "registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
                  "product_id": "registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vllm-spyre-rhel9@sha256%3A54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0?arch=amd64\u0026repository_url=registry.redhat.io/rhaii/vllm-spyre-rhel9\u0026tag=1787151840"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x as a component of Red Hat AI Inference Server 3.4",
          "product_id": "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x"
        },
        "product_reference": "registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64 as a component of Red Hat AI Inference Server 3.4",
          "product_id": "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64"
        },
        "product_reference": "registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le as a component of Red Hat AI Inference Server 3.4",
          "product_id": "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-34753",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2026-04-06T16:01:43.723837+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455394"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM. This server-side request forgery (SSRF) vulnerability allows an attacker who can control batch input JSON to force the vLLM batch runner to make arbitrary HTTP/HTTPS requests from the server. This can be exploited to access internal services, such as cloud metadata endpoints or internal HTTP APIs, potentially leading to information disclosure or further compromise of the host system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Server-Side Request Forgery allows access to internal services via controlled batch input",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34753"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455394",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455394"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34753",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34753"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34753",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34753"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr"
        }
      ],
      "release_date": "2026-04-06T15:36:52.942000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:57:23+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57387",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57387"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vllm: vLLM: Server-Side Request Forgery allows access to internal services via controlled batch input"
    },
    {
      "cve": "CVE-2026-34755",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-06T16:02:21.718949+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455403"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models. A remote attacker can exploit a vulnerability in the VideoMediaIO.load_base64() method by sending a single API request containing a large number of comma-separated base64-encoded JPEG frames. This bypasses the intended frame count limit, causing the server to decode all frames into memory. This can lead to an Out-of-Memory (OOM) crash, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vLLM: vLLM: Denial of Service due to excessive video frame processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34755"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455403",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455403"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34755",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34755"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34755",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34755"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p"
        }
      ],
      "release_date": "2026-04-06T15:38:53.201000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:57:23+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57387",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57387"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vLLM: vLLM: Denial of Service due to excessive video frame processing"
    },
    {
      "cve": "CVE-2026-34756",
      "cwe": {
        "id": "CWE-1284",
        "name": "Improper Validation of Specified Quantity in Input"
      },
      "discovery_date": "2026-04-06T16:03:45.222577+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455425"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large \u0027n\u0027 parameter to the vLLM OpenAI-compatible API server. This can lead to a Denial of Service (DoS) by consuming excessive memory and blocking the system\u0027s event loop, causing the server to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Denial of Service via excessively large \u0027n\u0027 parameter in OpenAI-compatible API",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34756"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455425",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455425"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34756",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34756"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34756",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34756"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/commit/b111f8a61f100fdca08706f41f29ef3548de7380",
          "url": "https://github.com/vllm-project/vllm/commit/b111f8a61f100fdca08706f41f29ef3548de7380"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/pull/37952",
          "url": "https://github.com/vllm-project/vllm/pull/37952"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-3mwp-wvh9-7528",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-3mwp-wvh9-7528"
        }
      ],
      "release_date": "2026-04-06T15:40:03.448000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:57:23+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57387",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57387"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vllm: vLLM: Denial of Service via excessively large \u0027n\u0027 parameter in OpenAI-compatible API"
    },
    {
      "cve": "CVE-2026-40192",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-04-16T00:00:49.590876+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2458856"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to trigger a denial of service (DoS) by providing a specially crafted FITS image file. The library\u0027s failure to limit the amount of GZIP-compressed data during decoding can lead to unbounded memory consumption, causing the system to crash or experience severe performance issues.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-40192"
        },
        {
          "category": "external",
          "summary": "RHBZ#2458856",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458856"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-40192",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40192"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40192",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40192"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628",
          "url": "https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9521",
          "url": "https://github.com/python-pillow/Pillow/pull/9521"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j"
        },
        {
          "category": "external",
          "summary": "https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb",
          "url": "https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb"
        }
      ],
      "release_date": "2026-04-15T22:53:56.147000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:57:23+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57387",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57387"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing"
    },
    {
      "cve": "CVE-2026-41523",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-06-22T23:01:00.799590+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491582"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit an assert-based security check during activation function loading. By publishing a malicious HuggingFace model, an attacker can achieve arbitrary code execution on the server when vLLM runs in Python optimized mode.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Arbitrary code execution via malicious HuggingFace model",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this issue as having Important impact for Red Hat AI Inference Server and Red Hat OpenShift AI vLLM serving images, and Moderate impact for Red Hat Enterprise Linux AI bootc images that bundle vLLM. Exploitation requires loading an untrusted HuggingFace cross-encoder model while the vLLM process runs with Python optimized mode (python -O or PYTHONOPTIMIZE=1). Red Hat AI Inference Server 3.2/3.3 images and other components without the vulnerable pooler activation loader (vLLM \u003c 0.14.0) are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41523"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491582",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491582"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41523",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41523"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41523",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41523"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3",
          "url": "https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r"
        },
        {
          "category": "external",
          "summary": "https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c",
          "url": "https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c"
        }
      ],
      "release_date": "2026-06-22T22:18:14.494000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:57:23+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57387",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57387"
        },
        {
          "category": "workaround",
          "details": "Avoid running vLLM with python -O or PYTHONOPTIMIZE=1 until updated packages are available. Only load models from trusted sources. Restrict who can deploy or update models on inference endpoints. Apply network access controls and authentication in front of vLLM APIs.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vllm: vLLM: Arbitrary code execution via malicious HuggingFace model"
    },
    {
      "cve": "CVE-2026-42308",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-05-09T06:01:07.510498+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2468457"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. If a font advances for each glyph by an exceeding large amount, an integer overflow can occur when Pillow tracks the current position. This could lead to a denial of service (DoS) condition, making the application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: python: Pillow: Denial of Service via integer overflow in font processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42308"
        },
        {
          "category": "external",
          "summary": "RHBZ#2468457",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468457"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42308",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42308"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42308",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42308"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.2.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.2.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j"
        }
      ],
      "release_date": "2026-05-09T04:09:01.631000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:57:23+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57387",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57387"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that applications utilizing the Pillow library do not process untrusted or maliciously crafted font files. Additionally, consider running applications that process image data in a sandboxed environment to limit potential impact. Reloading or restarting affected services may be required for changes to take effect.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Pillow: python: Pillow: Denial of Service via integer overflow in font processing"
    },
    {
      "cve": "CVE-2026-42309",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-05-09T06:01:11.401932+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2468458"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. A malicious actor could exploit this vulnerability by providing specially crafted nested lists as coordinates to image processing APIs within Pillow. This could lead to a heap buffer overflow, potentially causing a denial of service in applications using the library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Denial of Service via specially crafted coordinate input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact vulnerability in the Pillow Python imaging library could lead to a denial of service. Applications processing untrusted image data that utilize specific Pillow APIs, such as `ImagePath.Path`, `ImageDraw.ImageDraw.polygon`, or `ImageDraw.ImageDraw.line`, with specially crafted nested list coordinates are susceptible to a heap buffer overflow.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42309"
        },
        {
          "category": "external",
          "summary": "RHBZ#2468458",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468458"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42309",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42309"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42309",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42309"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.2.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.2.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2"
        }
      ],
      "release_date": "2026-05-09T04:08:10.517000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:57:23+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57387",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57387"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Pillow: Pillow: Denial of Service via specially crafted coordinate input"
    },
    {
      "cve": "CVE-2026-42310",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-05-09T06:01:21.465052+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2468461"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could supply a specially crafted malicious PDF file, causing the application to hang indefinitely and consume 100% CPU. This vulnerability leads to a Denial of Service (DoS), making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Denial of Service via malicious PDF processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42310"
        },
        {
          "category": "external",
          "summary": "RHBZ#2468461",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468461"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42310",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42310"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42310",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42310"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468",
          "url": "https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9519",
          "url": "https://github.com/python-pillow/Pillow/pull/9519"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.2.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.2.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7"
        }
      ],
      "release_date": "2026-05-09T04:10:48.395000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:57:23+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57387",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57387"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Pillow: Pillow: Denial of Service via malicious PDF processing"
    },
    {
      "cve": "CVE-2026-42311",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-05-09T06:01:14.891885+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2468459"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. An attacker could exploit this vulnerability by tricking a user into processing a specially crafted malicious PSD file. This could lead to memory corruption, potentially causing the application to crash or allowing for arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important severity flaw in Pillow, a Python imaging library, that could lead to arbitrary code execution. The vulnerability requires a user to process a specially crafted malicious PSD file, which could result in memory corruption and allow an attacker to execute arbitrary code. Red Hat products that process untrusted image files using Pillow are at risk if they do not adequately sanitize input or operate in a sandboxed environment.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42311"
        },
        {
          "category": "external",
          "summary": "RHBZ#2468459",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468459"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42311",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42311"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42311",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42311"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea",
          "url": "https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9520",
          "url": "https://github.com/python-pillow/Pillow/pull/9520"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.2.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.2.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88gr",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88gr"
        }
      ],
      "release_date": "2026-05-09T04:11:58.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:57:23+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57387",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57387"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, users should avoid processing untrusted or suspicious PSD image files with applications that utilize the Pillow library. Implementing strict input validation and sanitization for image uploads and processing workflows can reduce the risk. Additionally, running applications that process untrusted content within a sandboxed environment can limit the potential impact of successful exploitation.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing"
    },
    {
      "cve": "CVE-2026-44223",
      "cwe": {
        "id": "CWE-130",
        "name": "Improper Handling of Length Parameter Inconsistency"
      },
      "discovery_date": "2026-05-12T21:02:06.713372+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). The extract_hidden_states speculative decoding proposer returns a tensor with an incorrect shape after the first decode step. This can be triggered by a remote attacker sending a request that uses sampling penalty parameters, such as repetition_penalty, frequency_penalty, or presence_penalty. Successful exploitation leads to a RuntimeError that crashes the EngineCore process, resulting in a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Denial of Service via malformed tensor shape in speculative decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in vLLM, as used in Red Hat AI Inference Server and Red Hat OpenShift AI, allows a remote attacker to crash the EngineCore process. By sending a request with specific sampling penalty parameters, an attacker can trigger an incorrect tensor shape, leading to a service disruption for affected AI inference workloads.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44223"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44223",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44223"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44223",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44223"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/pull/38610",
          "url": "https://github.com/vllm-project/vllm/pull/38610"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-83vm-p52w-f9pw",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-83vm-p52w-f9pw"
        }
      ],
      "release_date": "2026-05-12T19:58:40.862000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:57:23+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57387",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57387"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:3657354eb0edeb7e0e9aad2a434d7f264626b3d906f4e3e8502a95a73772ca41_s390x",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:54ad323a1a44f99991ca9d28cf0a364a44c5bbce143891936f6c668612c3ffb0_amd64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:b35ecb302c7f4e270f44bf70b7f7f8d053eb74761b1104fea346af9a8e089d09_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vllm: vLLM: Denial of Service via malformed tensor shape in speculative decoding"
    }
  ]
}

RHSA-2026:57389

Vulnerability from csaf_redhat - Published: 2026-08-20 07:58 - Updated: 2026-08-23 19:01

Summary

Red Hat Security Advisory: Red Hat AI Inference 3.4.4 (cuda)

Severity

Important

Notes

Topic: Red Hat AI Inference 3.4.4 (cuda) is now available.

Details: Red Hat AI Inference

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-34753

A flaw was found in vLLM. This server-side request forgery (SSRF) vulnerability allows an attacker who can control batch input JSON to force the vLLM batch runner to make arbitrary HTTP/HTTPS requests from the server. This can be exploited to access internal services, such as cloud metadata endpoints or internal HTTP APIs, potentially leading to information disclosure or further compromise of the host system.

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

CWE-918 - Server-Side Request Forgery (SSRF)

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64		—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-34755

A flaw was found in vLLM, an inference and serving engine for large language models. A remote attacker can exploit a vulnerability in the VideoMediaIO.load_base64() method by sending a single API request containing a large number of comma-separated base64-encoded JPEG frames. This bypasses the intended frame count limit, causing the server to decode all frames into memory. This can lead to an Out-of-Memory (OOM) crash, resulting in a Denial of Service (DoS) for the affected system.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64		—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-34756

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large 'n' parameter to the vLLM OpenAI-compatible API server. This can lead to a Denial of Service (DoS) by consuming excessive memory and blocking the system's event loop, causing the server to crash.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-1284 - Improper Validation of Specified Quantity in Input

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64		—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-41523

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit an assert-based security check during activation function loading. By publishing a malicious HuggingFace model, an attacker can achieve arbitrary code execution on the server when vLLM runs in Python optimized mode.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64		—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-44223

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). The extract_hidden_states speculative decoding proposer returns a tensor with an incorrect shape after the first decode step. This can be triggered by a remote attacker sending a request that uses sampling penalty parameters, such as repetition_penalty, frequency_penalty, or presence_penalty. Successful exploitation leads to a RuntimeError that crashes the EngineCore process, resulting in a denial of service (DoS).

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-130 - Improper Handling of Length Parameter Inconsistency

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64		—	Vendor Fix fix Workaround

Threats

Impact Important

References

39 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:57389	self
https://access.redhat.com/security/cve/CVE-2026-34753	external
https://access.redhat.com/security/cve/CVE-2026-34755	external
https://access.redhat.com/security/cve/CVE-2026-34756	external
https://access.redhat.com/security/cve/CVE-2026-41523	external
https://access.redhat.com/security/cve/CVE-2026-44223	external
https://access.redhat.com/security/updates/classi…	external
https://www.redhat.com/en/products/ai/inference-server	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-34753	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455394	external
https://www.cve.org/CVERecord?id=CVE-2026-34753	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34753	external
https://github.com/vllm-project/vllm/security/adv…	external
https://access.redhat.com/security/cve/CVE-2026-34755	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455403	external
https://www.cve.org/CVERecord?id=CVE-2026-34755	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34755	external
https://github.com/vllm-project/vllm/security/adv…	external
https://access.redhat.com/security/cve/CVE-2026-34756	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455425	external
https://www.cve.org/CVERecord?id=CVE-2026-34756	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34756	external
https://github.com/vllm-project/vllm/commit/b111f…	external
https://github.com/vllm-project/vllm/pull/37952	external
https://github.com/vllm-project/vllm/security/adv…	external
https://access.redhat.com/security/cve/CVE-2026-41523	self
https://bugzilla.redhat.com/show_bug.cgi?id=2491582	external
https://www.cve.org/CVERecord?id=CVE-2026-41523	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41523	external
https://github.com/vllm-project/vllm/commit/b3c7f…	external
https://github.com/vllm-project/vllm/security/adv…	external
https://huntr.com/bounties/dcb05b04-e625-41e7-adb…	external
https://access.redhat.com/security/cve/CVE-2026-44223	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476827	external
https://www.cve.org/CVERecord?id=CVE-2026-44223	external
https://nvd.nist.gov/vuln/detail/CVE-2026-44223	external
https://github.com/vllm-project/vllm/pull/38610	external
https://github.com/vllm-project/vllm/security/adv…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AI Inference 3.4.4 (cuda) is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat AI Inference",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:57389",
        "url": "https://access.redhat.com/errata/RHSA-2026:57389"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34753",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34753"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34755",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34755"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34756",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34756"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41523",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41523"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44223",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44223"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://www.redhat.com/en/products/ai/inference-server",
        "url": "https://www.redhat.com/en/products/ai/inference-server"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57389.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AI Inference 3.4.4 (cuda)",
    "tracking": {
      "current_release_date": "2026-08-23T19:01:46+00:00",
      "generator": {
        "date": "2026-08-23T19:01:46+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:57389",
      "initial_release_date": "2026-08-20T07:58:06+00:00",
      "revision_history": [
        {
          "date": "2026-08-20T07:58:06+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T06:15:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-23T19:01:46+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat AI Inference Server 3.4",
                "product": {
                  "name": "Red Hat AI Inference Server 3.4",
                  "product_id": "Red Hat AI Inference Server 3.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ai_inference_server:3.4::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat AI Inference Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64",
                "product": {
                  "name": "registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64",
                  "product_id": "registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vllm-cuda-rhel9@sha256%3Ad2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5?arch=amd64\u0026repository_url=registry.redhat.io/rhaii/vllm-cuda-rhel9\u0026tag=1787151771"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
                "product": {
                  "name": "registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
                  "product_id": "registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vllm-cuda-rhel9@sha256%3A5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248?arch=arm64\u0026repository_url=registry.redhat.io/rhaii/vllm-cuda-rhel9\u0026tag=1787151771"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64 as a component of Red Hat AI Inference Server 3.4",
          "product_id": "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64"
        },
        "product_reference": "registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64 as a component of Red Hat AI Inference Server 3.4",
          "product_id": "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
        },
        "product_reference": "registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-34753",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2026-04-06T16:01:43.723837+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455394"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM. This server-side request forgery (SSRF) vulnerability allows an attacker who can control batch input JSON to force the vLLM batch runner to make arbitrary HTTP/HTTPS requests from the server. This can be exploited to access internal services, such as cloud metadata endpoints or internal HTTP APIs, potentially leading to information disclosure or further compromise of the host system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Server-Side Request Forgery allows access to internal services via controlled batch input",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34753"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455394",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455394"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34753",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34753"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34753",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34753"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr"
        }
      ],
      "release_date": "2026-04-06T15:36:52.942000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:58:06+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57389",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57389"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vllm: vLLM: Server-Side Request Forgery allows access to internal services via controlled batch input"
    },
    {
      "cve": "CVE-2026-34755",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-06T16:02:21.718949+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455403"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models. A remote attacker can exploit a vulnerability in the VideoMediaIO.load_base64() method by sending a single API request containing a large number of comma-separated base64-encoded JPEG frames. This bypasses the intended frame count limit, causing the server to decode all frames into memory. This can lead to an Out-of-Memory (OOM) crash, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vLLM: vLLM: Denial of Service due to excessive video frame processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34755"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455403",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455403"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34755",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34755"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34755",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34755"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p"
        }
      ],
      "release_date": "2026-04-06T15:38:53.201000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:58:06+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57389",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57389"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vLLM: vLLM: Denial of Service due to excessive video frame processing"
    },
    {
      "cve": "CVE-2026-34756",
      "cwe": {
        "id": "CWE-1284",
        "name": "Improper Validation of Specified Quantity in Input"
      },
      "discovery_date": "2026-04-06T16:03:45.222577+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455425"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large \u0027n\u0027 parameter to the vLLM OpenAI-compatible API server. This can lead to a Denial of Service (DoS) by consuming excessive memory and blocking the system\u0027s event loop, causing the server to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Denial of Service via excessively large \u0027n\u0027 parameter in OpenAI-compatible API",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34756"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455425",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455425"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34756",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34756"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34756",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34756"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/commit/b111f8a61f100fdca08706f41f29ef3548de7380",
          "url": "https://github.com/vllm-project/vllm/commit/b111f8a61f100fdca08706f41f29ef3548de7380"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/pull/37952",
          "url": "https://github.com/vllm-project/vllm/pull/37952"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-3mwp-wvh9-7528",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-3mwp-wvh9-7528"
        }
      ],
      "release_date": "2026-04-06T15:40:03.448000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:58:06+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57389",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57389"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vllm: vLLM: Denial of Service via excessively large \u0027n\u0027 parameter in OpenAI-compatible API"
    },
    {
      "cve": "CVE-2026-41523",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-06-22T23:01:00.799590+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491582"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit an assert-based security check during activation function loading. By publishing a malicious HuggingFace model, an attacker can achieve arbitrary code execution on the server when vLLM runs in Python optimized mode.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Arbitrary code execution via malicious HuggingFace model",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this issue as having Important impact for Red Hat AI Inference Server and Red Hat OpenShift AI vLLM serving images, and Moderate impact for Red Hat Enterprise Linux AI bootc images that bundle vLLM. Exploitation requires loading an untrusted HuggingFace cross-encoder model while the vLLM process runs with Python optimized mode (python -O or PYTHONOPTIMIZE=1). Red Hat AI Inference Server 3.2/3.3 images and other components without the vulnerable pooler activation loader (vLLM \u003c 0.14.0) are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41523"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491582",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491582"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41523",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41523"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41523",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41523"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3",
          "url": "https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r"
        },
        {
          "category": "external",
          "summary": "https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c",
          "url": "https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c"
        }
      ],
      "release_date": "2026-06-22T22:18:14.494000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:58:06+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57389",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57389"
        },
        {
          "category": "workaround",
          "details": "Avoid running vLLM with python -O or PYTHONOPTIMIZE=1 until updated packages are available. Only load models from trusted sources. Restrict who can deploy or update models on inference endpoints. Apply network access controls and authentication in front of vLLM APIs.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vllm: vLLM: Arbitrary code execution via malicious HuggingFace model"
    },
    {
      "cve": "CVE-2026-44223",
      "cwe": {
        "id": "CWE-130",
        "name": "Improper Handling of Length Parameter Inconsistency"
      },
      "discovery_date": "2026-05-12T21:02:06.713372+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). The extract_hidden_states speculative decoding proposer returns a tensor with an incorrect shape after the first decode step. This can be triggered by a remote attacker sending a request that uses sampling penalty parameters, such as repetition_penalty, frequency_penalty, or presence_penalty. Successful exploitation leads to a RuntimeError that crashes the EngineCore process, resulting in a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Denial of Service via malformed tensor shape in speculative decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in vLLM, as used in Red Hat AI Inference Server and Red Hat OpenShift AI, allows a remote attacker to crash the EngineCore process. By sending a request with specific sampling penalty parameters, an attacker can trigger an incorrect tensor shape, leading to a service disruption for affected AI inference workloads.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44223"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44223",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44223"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44223",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44223"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/pull/38610",
          "url": "https://github.com/vllm-project/vllm/pull/38610"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-83vm-p52w-f9pw",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-83vm-p52w-f9pw"
        }
      ],
      "release_date": "2026-05-12T19:58:40.862000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:58:06+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57389",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57389"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:5da7a63ad71f6d047a35bfbd572a141be894bae84e60a2b22a237116c477a248_arm64",
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:d2ed07d307845135c089bc7644b64734b9349d517abf746c9aa0aa23ed263da5_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vllm: vLLM: Denial of Service via malformed tensor shape in speculative decoding"
    }
  ]
}

RHSA-2026:57390

Vulnerability from csaf_redhat - Published: 2026-08-20 07:58 - Updated: 2026-08-23 19:01

Summary

Red Hat Security Advisory: Red Hat AI Inference 3.4.4 (rocm)

Severity

Important

Notes

Topic: Red Hat AI Inference 3.4.4 (rocm) is now available.

Details: Red Hat AI Inference

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-34753

A flaw was found in vLLM. This server-side request forgery (SSRF) vulnerability allows an attacker who can control batch input JSON to force the vLLM batch runner to make arbitrary HTTP/HTTPS requests from the server. This can be exploited to access internal services, such as cloud metadata endpoints or internal HTTP APIs, potentially leading to information disclosure or further compromise of the host system.

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

CWE-918 - Server-Side Request Forgery (SSRF)

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64		—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-34755

A flaw was found in vLLM, an inference and serving engine for large language models. A remote attacker can exploit a vulnerability in the VideoMediaIO.load_base64() method by sending a single API request containing a large number of comma-separated base64-encoded JPEG frames. This bypasses the intended frame count limit, causing the server to decode all frames into memory. This can lead to an Out-of-Memory (OOM) crash, resulting in a Denial of Service (DoS) for the affected system.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64		—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-34756

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large 'n' parameter to the vLLM OpenAI-compatible API server. This can lead to a Denial of Service (DoS) by consuming excessive memory and blocking the system's event loop, causing the server to crash.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-1284 - Improper Validation of Specified Quantity in Input

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64		—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-41523

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit an assert-based security check during activation function loading. By publishing a malicious HuggingFace model, an attacker can achieve arbitrary code execution on the server when vLLM runs in Python optimized mode.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64		—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-44223

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). The extract_hidden_states speculative decoding proposer returns a tensor with an incorrect shape after the first decode step. This can be triggered by a remote attacker sending a request that uses sampling penalty parameters, such as repetition_penalty, frequency_penalty, or presence_penalty. Successful exploitation leads to a RuntimeError that crashes the EngineCore process, resulting in a denial of service (DoS).

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-130 - Improper Handling of Length Parameter Inconsistency

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64		—	Vendor Fix fix Workaround

Threats

Impact Important

References

39 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:57390	self
https://access.redhat.com/security/cve/CVE-2026-34753	external
https://access.redhat.com/security/cve/CVE-2026-34755	external
https://access.redhat.com/security/cve/CVE-2026-34756	external
https://access.redhat.com/security/cve/CVE-2026-41523	external
https://access.redhat.com/security/cve/CVE-2026-44223	external
https://access.redhat.com/security/updates/classi…	external
https://www.redhat.com/en/products/ai/inference-server	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-34753	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455394	external
https://www.cve.org/CVERecord?id=CVE-2026-34753	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34753	external
https://github.com/vllm-project/vllm/security/adv…	external
https://access.redhat.com/security/cve/CVE-2026-34755	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455403	external
https://www.cve.org/CVERecord?id=CVE-2026-34755	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34755	external
https://github.com/vllm-project/vllm/security/adv…	external
https://access.redhat.com/security/cve/CVE-2026-34756	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455425	external
https://www.cve.org/CVERecord?id=CVE-2026-34756	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34756	external
https://github.com/vllm-project/vllm/commit/b111f…	external
https://github.com/vllm-project/vllm/pull/37952	external
https://github.com/vllm-project/vllm/security/adv…	external
https://access.redhat.com/security/cve/CVE-2026-41523	self
https://bugzilla.redhat.com/show_bug.cgi?id=2491582	external
https://www.cve.org/CVERecord?id=CVE-2026-41523	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41523	external
https://github.com/vllm-project/vllm/commit/b3c7f…	external
https://github.com/vllm-project/vllm/security/adv…	external
https://huntr.com/bounties/dcb05b04-e625-41e7-adb…	external
https://access.redhat.com/security/cve/CVE-2026-44223	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476827	external
https://www.cve.org/CVERecord?id=CVE-2026-44223	external
https://nvd.nist.gov/vuln/detail/CVE-2026-44223	external
https://github.com/vllm-project/vllm/pull/38610	external
https://github.com/vllm-project/vllm/security/adv…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AI Inference 3.4.4 (rocm) is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat AI Inference",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:57390",
        "url": "https://access.redhat.com/errata/RHSA-2026:57390"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34753",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34753"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34755",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34755"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34756",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34756"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41523",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41523"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44223",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44223"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://www.redhat.com/en/products/ai/inference-server",
        "url": "https://www.redhat.com/en/products/ai/inference-server"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57390.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AI Inference 3.4.4 (rocm)",
    "tracking": {
      "current_release_date": "2026-08-23T19:01:58+00:00",
      "generator": {
        "date": "2026-08-23T19:01:58+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:57390",
      "initial_release_date": "2026-08-20T07:58:42+00:00",
      "revision_history": [
        {
          "date": "2026-08-20T07:58:42+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T06:15:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-23T19:01:58+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat AI Inference Server 3.4",
                "product": {
                  "name": "Red Hat AI Inference Server 3.4",
                  "product_id": "Red Hat AI Inference Server 3.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ai_inference_server:3.4::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat AI Inference Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64",
                "product": {
                  "name": "registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64",
                  "product_id": "registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vllm-rocm-rhel9@sha256%3Aeb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2?arch=amd64\u0026repository_url=registry.redhat.io/rhaii/vllm-rocm-rhel9\u0026tag=1787151774"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64 as a component of Red Hat AI Inference Server 3.4",
          "product_id": "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
        },
        "product_reference": "registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-34753",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2026-04-06T16:01:43.723837+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455394"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM. This server-side request forgery (SSRF) vulnerability allows an attacker who can control batch input JSON to force the vLLM batch runner to make arbitrary HTTP/HTTPS requests from the server. This can be exploited to access internal services, such as cloud metadata endpoints or internal HTTP APIs, potentially leading to information disclosure or further compromise of the host system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Server-Side Request Forgery allows access to internal services via controlled batch input",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34753"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455394",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455394"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34753",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34753"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34753",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34753"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr"
        }
      ],
      "release_date": "2026-04-06T15:36:52.942000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:58:42+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57390",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57390"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vllm: vLLM: Server-Side Request Forgery allows access to internal services via controlled batch input"
    },
    {
      "cve": "CVE-2026-34755",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-06T16:02:21.718949+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455403"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models. A remote attacker can exploit a vulnerability in the VideoMediaIO.load_base64() method by sending a single API request containing a large number of comma-separated base64-encoded JPEG frames. This bypasses the intended frame count limit, causing the server to decode all frames into memory. This can lead to an Out-of-Memory (OOM) crash, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vLLM: vLLM: Denial of Service due to excessive video frame processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34755"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455403",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455403"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34755",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34755"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34755",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34755"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p"
        }
      ],
      "release_date": "2026-04-06T15:38:53.201000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:58:42+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57390",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57390"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vLLM: vLLM: Denial of Service due to excessive video frame processing"
    },
    {
      "cve": "CVE-2026-34756",
      "cwe": {
        "id": "CWE-1284",
        "name": "Improper Validation of Specified Quantity in Input"
      },
      "discovery_date": "2026-04-06T16:03:45.222577+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455425"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large \u0027n\u0027 parameter to the vLLM OpenAI-compatible API server. This can lead to a Denial of Service (DoS) by consuming excessive memory and blocking the system\u0027s event loop, causing the server to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Denial of Service via excessively large \u0027n\u0027 parameter in OpenAI-compatible API",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34756"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455425",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455425"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34756",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34756"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34756",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34756"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/commit/b111f8a61f100fdca08706f41f29ef3548de7380",
          "url": "https://github.com/vllm-project/vllm/commit/b111f8a61f100fdca08706f41f29ef3548de7380"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/pull/37952",
          "url": "https://github.com/vllm-project/vllm/pull/37952"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-3mwp-wvh9-7528",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-3mwp-wvh9-7528"
        }
      ],
      "release_date": "2026-04-06T15:40:03.448000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:58:42+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57390",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57390"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vllm: vLLM: Denial of Service via excessively large \u0027n\u0027 parameter in OpenAI-compatible API"
    },
    {
      "cve": "CVE-2026-41523",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-06-22T23:01:00.799590+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491582"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit an assert-based security check during activation function loading. By publishing a malicious HuggingFace model, an attacker can achieve arbitrary code execution on the server when vLLM runs in Python optimized mode.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Arbitrary code execution via malicious HuggingFace model",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this issue as having Important impact for Red Hat AI Inference Server and Red Hat OpenShift AI vLLM serving images, and Moderate impact for Red Hat Enterprise Linux AI bootc images that bundle vLLM. Exploitation requires loading an untrusted HuggingFace cross-encoder model while the vLLM process runs with Python optimized mode (python -O or PYTHONOPTIMIZE=1). Red Hat AI Inference Server 3.2/3.3 images and other components without the vulnerable pooler activation loader (vLLM \u003c 0.14.0) are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41523"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491582",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491582"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41523",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41523"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41523",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41523"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3",
          "url": "https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r"
        },
        {
          "category": "external",
          "summary": "https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c",
          "url": "https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c"
        }
      ],
      "release_date": "2026-06-22T22:18:14.494000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:58:42+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57390",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57390"
        },
        {
          "category": "workaround",
          "details": "Avoid running vLLM with python -O or PYTHONOPTIMIZE=1 until updated packages are available. Only load models from trusted sources. Restrict who can deploy or update models on inference endpoints. Apply network access controls and authentication in front of vLLM APIs.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vllm: vLLM: Arbitrary code execution via malicious HuggingFace model"
    },
    {
      "cve": "CVE-2026-44223",
      "cwe": {
        "id": "CWE-130",
        "name": "Improper Handling of Length Parameter Inconsistency"
      },
      "discovery_date": "2026-05-12T21:02:06.713372+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). The extract_hidden_states speculative decoding proposer returns a tensor with an incorrect shape after the first decode step. This can be triggered by a remote attacker sending a request that uses sampling penalty parameters, such as repetition_penalty, frequency_penalty, or presence_penalty. Successful exploitation leads to a RuntimeError that crashes the EngineCore process, resulting in a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vllm: vLLM: Denial of Service via malformed tensor shape in speculative decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in vLLM, as used in Red Hat AI Inference Server and Red Hat OpenShift AI, allows a remote attacker to crash the EngineCore process. By sending a request with specific sampling penalty parameters, an attacker can trigger an incorrect tensor shape, leading to a service disruption for affected AI inference workloads.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44223"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44223",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44223"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44223",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44223"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/pull/38610",
          "url": "https://github.com/vllm-project/vllm/pull/38610"
        },
        {
          "category": "external",
          "summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-83vm-p52w-f9pw",
          "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-83vm-p52w-f9pw"
        }
      ],
      "release_date": "2026-05-12T19:58:40.862000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T07:58:42+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57390",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57390"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vllm: vLLM: Denial of Service via malformed tensor shape in speculative decoding"
    }
  ]
}

WID-SEC-W-2026-0987

Vulnerability from csaf_certbund - Published: 2026-04-07 22:00 - Updated: 2026-04-07 22:00

Summary

vllm: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Open Source vLLM ist eine Open-Source-Bibliothek für schnelle und effiziente Inferenz von Large Language Models (LLMs).

Angriff: Ein Angreifer kann mehrere Schwachstellen in vllm ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.

Betroffene Betriebssysteme: - Sonstiges - UNIX

CVE-2026-34753

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source vllm <0.19.0 Open Source / vllm		<0.19.0

CVE-2026-34755

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source vllm <0.19.0 Open Source / vllm		<0.19.0

CVE-2026-34756

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source vllm <0.19.0 Open Source / vllm		<0.19.0

CVE-2026-34760

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source vllm <0.19.0 Open Source / vllm		<0.19.0

References

7 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://github.com/vllm-project/vllm/security/adv…	external
https://github.com/vllm-project/vllm/security/adv…	external
https://github.com/vllm-project/vllm/security/adv…	external
https://github.com/vllm-project/vllm/security/adv…	external
https://github.com/vllm-project/vllm/releases	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Open Source vLLM ist eine Open-Source-Bibliothek f\u00fcr schnelle und effiziente Inferenz von Large Language Models (LLMs).",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in vllm ausnutzen, um Dateien zu manipulieren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0987 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0987.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0987 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0987"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-pf3h-qjgv-vcpr vom 2026-04-07",
        "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-pq5c-rjhq-qp7p vom 2026-04-07",
        "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-3mwp-wvh9-7528 vom 2026-04-07",
        "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-3mwp-wvh9-7528"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-6c4r-fmh3-7rh8 vom 2026-04-07",
        "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-6c4r-fmh3-7rh8"
      },
      {
        "category": "external",
        "summary": "vllm releases vom 2026-04-07",
        "url": "https://github.com/vllm-project/vllm/releases"
      }
    ],
    "source_lang": "en-US",
    "title": "vllm: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-04-07T22:00:00.000+00:00",
      "generator": {
        "date": "2026-04-08T09:54:21.440+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0987",
      "initial_release_date": "2026-04-07T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-04-07T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c0.19.0",
                "product": {
                  "name": "Open Source vllm \u003c0.19.0",
                  "product_id": "T052442"
                }
              },
              {
                "category": "product_version",
                "name": "0.19.0",
                "product": {
                  "name": "Open Source vllm 0.19.0",
                  "product_id": "T052442-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vllm:vllm:0.19.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "vllm"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-34753",
      "product_status": {
        "known_affected": [
          "T052442"
        ]
      },
      "release_date": "2026-04-07T22:00:00.000+00:00",
      "title": "CVE-2026-34753"
    },
    {
      "cve": "CVE-2026-34755",
      "product_status": {
        "known_affected": [
          "T052442"
        ]
      },
      "release_date": "2026-04-07T22:00:00.000+00:00",
      "title": "CVE-2026-34755"
    },
    {
      "cve": "CVE-2026-34756",
      "product_status": {
        "known_affected": [
          "T052442"
        ]
      },
      "release_date": "2026-04-07T22:00:00.000+00:00",
      "title": "CVE-2026-34756"
    },
    {
      "cve": "CVE-2026-34760",
      "product_status": {
        "known_affected": [
          "T052442"
        ]
      },
      "release_date": "2026-04-07T22:00:00.000+00:00",
      "title": "CVE-2026-34760"
    }
  ]
}

CVE-2026-34753 (GCVE-0-2026-34753)

Tags

Sightings

Nomenclature

Action not permitted

CVE-2026-34753 (GCVE-0-2026-34753)

Summary

Details

Vulnerable component

URL controllability

Comparison with safer code

Summary

Details

Vulnerable component

URL controllability

Comparison with safer code

Tags

Sightings

Nomenclature