RHSA-2026:57390
Vulnerability from csaf_redhat - Published: 2026-08-20 07:58 - Updated: 2026-08-20 16:13Summary
Red Hat Security Advisory: Red Hat AI Inference 3.4.4 (rocm)
Severity
Important
Notes
Topic: Red Hat AI Inference 3.4.4 (rocm) is now available.
Details: Red Hat AI Inference
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in vLLM. This server-side request forgery (SSRF) vulnerability allows an attacker who can control batch input JSON to force the vLLM batch runner to make arbitrary HTTP/HTTPS requests from the server. This can be exploited to access internal services, such as cloud metadata endpoints or internal HTTP APIs, potentially leading to information disclosure or further compromise of the host system.
5.4 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in vLLM, an inference and serving engine for large language models. A remote attacker can exploit a vulnerability in the VideoMediaIO.load_base64() method by sending a single API request containing a large number of comma-separated base64-encoded JPEG frames. This bypasses the intended frame count limit, causing the server to decode all frames into memory. This can lead to an Out-of-Memory (OOM) crash, resulting in a Denial of Service (DoS) for the affected system.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large 'n' parameter to the vLLM OpenAI-compatible API server. This can lead to a Denial of Service (DoS) by consuming excessive memory and blocking the system's event loop, causing the server to crash.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit an assert-based security check during activation function loading. By publishing a malicious HuggingFace model, an attacker can achieve arbitrary code execution on the server when vLLM runs in Python optimized mode.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). The extract_hidden_states speculative decoding proposer returns a tensor with an incorrect shape after the first decode step. This can be triggered by a remote attacker sending a request that uses sampling penalty parameters, such as repetition_penalty, frequency_penalty, or presence_penalty. Successful exploitation leads to a RuntimeError that crashes the EngineCore process, resulting in a denial of service (DoS).
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
39 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat AI Inference 3.4.4 (rocm) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat AI Inference",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:57390",
"url": "https://access.redhat.com/errata/RHSA-2026:57390"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34753",
"url": "https://access.redhat.com/security/cve/CVE-2026-34753"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34755",
"url": "https://access.redhat.com/security/cve/CVE-2026-34755"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34756",
"url": "https://access.redhat.com/security/cve/CVE-2026-34756"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41523",
"url": "https://access.redhat.com/security/cve/CVE-2026-41523"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44223",
"url": "https://access.redhat.com/security/cve/CVE-2026-44223"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://www.redhat.com/en/products/ai/inference-server",
"url": "https://www.redhat.com/en/products/ai/inference-server"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57390.json"
}
],
"title": "Red Hat Security Advisory: Red Hat AI Inference 3.4.4 (rocm)",
"tracking": {
"current_release_date": "2026-08-20T16:13:41+00:00",
"generator": {
"date": "2026-08-20T16:13:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:57390",
"initial_release_date": "2026-08-20T07:58:42+00:00",
"revision_history": [
{
"date": "2026-08-20T07:58:42+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-20T07:59:01+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-20T16:13:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat AI Inference Server 3.4",
"product": {
"name": "Red Hat AI Inference Server 3.4",
"product_id": "Red Hat AI Inference Server 3.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ai_inference_server:3.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat AI Inference Server"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64",
"product": {
"name": "registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64",
"product_id": "registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/vllm-rocm-rhel9@sha256%3Aeb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2?arch=amd64\u0026repository_url=registry.redhat.io/rhaii/vllm-rocm-rhel9\u0026tag=1787151774"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64 as a component of Red Hat AI Inference Server 3.4",
"product_id": "Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
},
"product_reference": "registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64",
"relates_to_product_reference": "Red Hat AI Inference Server 3.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-34753",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-04-06T16:01:43.723837+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455394"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vLLM. This server-side request forgery (SSRF) vulnerability allows an attacker who can control batch input JSON to force the vLLM batch runner to make arbitrary HTTP/HTTPS requests from the server. This can be exploited to access internal services, such as cloud metadata endpoints or internal HTTP APIs, potentially leading to information disclosure or further compromise of the host system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vllm: vLLM: Server-Side Request Forgery allows access to internal services via controlled batch input",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34753"
},
{
"category": "external",
"summary": "RHBZ#2455394",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455394"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34753",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34753"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34753",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34753"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr"
}
],
"release_date": "2026-04-06T15:36:52.942000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-20T07:58:42+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57390",
"product_ids": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:57390"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vllm: vLLM: Server-Side Request Forgery allows access to internal services via controlled batch input"
},
{
"cve": "CVE-2026-34755",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-06T16:02:21.718949+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455403"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vLLM, an inference and serving engine for large language models. A remote attacker can exploit a vulnerability in the VideoMediaIO.load_base64() method by sending a single API request containing a large number of comma-separated base64-encoded JPEG frames. This bypasses the intended frame count limit, causing the server to decode all frames into memory. This can lead to an Out-of-Memory (OOM) crash, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vLLM: vLLM: Denial of Service due to excessive video frame processing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34755"
},
{
"category": "external",
"summary": "RHBZ#2455403",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455403"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34755",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34755"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34755",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34755"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-pq5c-rjhq-qp7p"
}
],
"release_date": "2026-04-06T15:38:53.201000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-20T07:58:42+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57390",
"product_ids": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:57390"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vLLM: vLLM: Denial of Service due to excessive video frame processing"
},
{
"cve": "CVE-2026-34756",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"discovery_date": "2026-04-06T16:03:45.222577+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455425"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large \u0027n\u0027 parameter to the vLLM OpenAI-compatible API server. This can lead to a Denial of Service (DoS) by consuming excessive memory and blocking the system\u0027s event loop, causing the server to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vllm: vLLM: Denial of Service via excessively large \u0027n\u0027 parameter in OpenAI-compatible API",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34756"
},
{
"category": "external",
"summary": "RHBZ#2455425",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455425"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34756",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34756"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34756",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34756"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/commit/b111f8a61f100fdca08706f41f29ef3548de7380",
"url": "https://github.com/vllm-project/vllm/commit/b111f8a61f100fdca08706f41f29ef3548de7380"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/pull/37952",
"url": "https://github.com/vllm-project/vllm/pull/37952"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-3mwp-wvh9-7528",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-3mwp-wvh9-7528"
}
],
"release_date": "2026-04-06T15:40:03.448000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-20T07:58:42+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57390",
"product_ids": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:57390"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vllm: vLLM: Denial of Service via excessively large \u0027n\u0027 parameter in OpenAI-compatible API"
},
{
"cve": "CVE-2026-41523",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-06-22T23:01:00.799590+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491582"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit an assert-based security check during activation function loading. By publishing a malicious HuggingFace model, an attacker can achieve arbitrary code execution on the server when vLLM runs in Python optimized mode.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vllm: vLLM: Arbitrary code execution via malicious HuggingFace model",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as having Important impact for Red Hat AI Inference Server and Red Hat OpenShift AI vLLM serving images, and Moderate impact for Red Hat Enterprise Linux AI bootc images that bundle vLLM. Exploitation requires loading an untrusted HuggingFace cross-encoder model while the vLLM process runs with Python optimized mode (python -O or PYTHONOPTIMIZE=1). Red Hat AI Inference Server 3.2/3.3 images and other components without the vulnerable pooler activation loader (vLLM \u003c 0.14.0) are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41523"
},
{
"category": "external",
"summary": "RHBZ#2491582",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491582"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41523",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41523"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41523",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41523"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3",
"url": "https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r"
},
{
"category": "external",
"summary": "https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c",
"url": "https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c"
}
],
"release_date": "2026-06-22T22:18:14.494000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-20T07:58:42+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57390",
"product_ids": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:57390"
},
{
"category": "workaround",
"details": "Avoid running vLLM with python -O or PYTHONOPTIMIZE=1 until updated packages are available. Only load models from trusted sources. Restrict who can deploy or update models on inference endpoints. Apply network access controls and authentication in front of vLLM APIs.",
"product_ids": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vllm: vLLM: Arbitrary code execution via malicious HuggingFace model"
},
{
"cve": "CVE-2026-44223",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"discovery_date": "2026-05-12T21:02:06.713372+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476827"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). The extract_hidden_states speculative decoding proposer returns a tensor with an incorrect shape after the first decode step. This can be triggered by a remote attacker sending a request that uses sampling penalty parameters, such as repetition_penalty, frequency_penalty, or presence_penalty. Successful exploitation leads to a RuntimeError that crashes the EngineCore process, resulting in a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vllm: vLLM: Denial of Service via malformed tensor shape in speculative decoding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in vLLM, as used in Red Hat AI Inference Server and Red Hat OpenShift AI, allows a remote attacker to crash the EngineCore process. By sending a request with specific sampling penalty parameters, an attacker can trigger an incorrect tensor shape, leading to a service disruption for affected AI inference workloads.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44223"
},
{
"category": "external",
"summary": "RHBZ#2476827",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476827"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44223",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44223"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44223",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44223"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/pull/38610",
"url": "https://github.com/vllm-project/vllm/pull/38610"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-83vm-p52w-f9pw",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-83vm-p52w-f9pw"
}
],
"release_date": "2026-05-12T19:58:40.862000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-20T07:58:42+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:57390",
"product_ids": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:57390"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:eb2ca896461f782d8c4c239d36545a1a749d17bebd9fdc0652024092614c69c2_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vllm: vLLM: Denial of Service via malformed tensor shape in speculative decoding"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…