Jperezdealgaba

**اسم البرنامج المصاب والإصدارات المتأثرة** vLLM الإصدارات السابقة لـ 0.29.0 **Description** يقوم البرنامج بتمرير الملفات الصوتية المرفوعة إلى نظام التراجع `av.open()` الخاص بـ PyAV/FFmpeg مع إجراء فحص لحجم الملف فقط، مما يعرض نظام تحليل IAMF في FFmpeg لثغرة تجاوز سعة ذاكرة التراكم (heap overflow). يمكن للمهاجمين عن بُعد المصرح لهم استغلال ذلك عن طريق رفع حاويات IAMF مشوهة بشكل متكرر إلى نقطة النهاية '/v1/audio/transcriptions'، مما يؤدي إلى تلف ذاكرة التراكم وتعطل عملية واجهة برمجة التطبيقات (API). **Recommendations** تحديث vLLM إلى الإصدار 0.29.0 أو إصدار أحدث.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.29.0 **Description** The software fails to validate if the values provided in `stop token ids` are within the model vocabulary or logits range, checking only that they are integers. When `min tokens` is greater than 0, these IDs are used as logits indices to suppress stop tokens. An out-of-range ID triggers a CUDA indexing operation (`index put `), leading to a device-side assertion. An authenticated API user can exploit this by sending a malformed request to the 'POST /v1/completions' or 'POST /v1/chat/completions' endpoints, resulting in a 500 Internal Server Error and placing the EngineCore into a fatal state. This causes a denial of service where subsequent requests fail until the service is restarted. Real-world incidents of this issue being exploited have been reported. **Recommendations** Update vLLM to version 0.29.0 or later.

**Name of the Vulnerable Software and Affected Versions** vllm versions prior to 0.29.0 **Description** The software fails to enforce the `VLLM MAX AUDIO CLIP FILESIZE MB` limit during multimodal chat audio decoding. This allows unauthenticated clients to bypass file size restrictions by submitting oversized audio files through chat endpoints, leading to excessive consumption of memory and CPU resources during the decoding process. **Recommendations** Update vllm to version 0.29.0 or later.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.29.0 **Description** A resource-limit bypass exists in the PyNvVideoCodec decoder allocation. This issue occurs because sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits, leading to the exhaustion of unaccounted GPU memory. **Recommendations** Update vLLM to version 0.29.0 or later.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.29.1 **Description** The server fetches and fully materializes remote or inline media before enforcing media controls, such as the `VLLM MAX AUDIO CLIP FILESIZE MB` size cap and the `--limit-mm-per-prompt` item limits. This occurs across four ingress paths: the shared media-acquisition layer `HTTPConnection.get bytes()`/`async get bytes()`, the chat completions `audio url`/`base64` path, the batch speech runner, and the Rust frontend `POST /tokenize` route. Because the server reads the entire HTTP response body or base64-decodes the payload before applying limits, a remote attacker can cause memory allocation and outbound bandwidth consumption proportional to the chosen body size or media item count. This leads to pre-inference memory and bandwidth exhaustion, resulting in a denial of service. While chat and batch surfaces may require an API key, the `POST /tokenize` route is unauthenticated. **Recommendations** Update to a version later than 0.29.0. Restrict access to the `POST /tokenize` route to minimize the risk of unauthenticated exploitation.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.29.0 **Description** The software fails to enforce decoder prompt-length validation on the disaggregated serving endpoint '/inference/v1/generate'. When a request includes a 'features' multimodal payload, the system builds a multimodal EngineInput using caller-supplied `token ids` without verifying them against `model config.max model len`. For specific multimodal processors that set `skip prompt length check` to true, such as Nemotron Parse, Whisper, and FireRedLID, the `InputProcessor. validate prompt len()` function returns immediately. This allows an overlong prompt to be processed as an EngineCoreRequest, which then causes a worker failure and denial of service when the input-batch is copied into a fixed-width NumPy row. **Recommendations** Update to version 0.29.0.

**Name of the Vulnerable Software and Affected Versions** vLLM versions 0.22.0 through 0.23.0 **Description** The Rust HTTP and gRPC frontends fail to validate `stop token ids` against vocabulary bounds, allowing out-of-vocabulary token IDs to reach the `MinTokensLogitsProcessor` function. An attacker can submit requests where `min tokens` is greater than zero and `stop token ids` are out-of-vocabulary, triggering CUDA tensor indexing failures. This results in the `EngineCore` entering a fatal state, which necessitates a service restart. **Recommendations** Update vLLM versions 0.22.0 through 0.23.0 to a newer version that implements proper validation for `stop token ids`.

**Name of the Vulnerable Software and Affected Versions** vLLM versions 0.22.1 through 0.27.9 **Description** A supply-chain integrity and reproducibility issue exists where the model revision pin provided via `--revision` or `--code-revision` is not propagated to specific Hugging Face artifact loads for FunAudioChat and Tarsier2 architectures. Specifically, this affects the `WhisperFeatureExtractor` and `speech tokenizer` `PreTrainedTokenizerFast` loads in `vllm/model executor/models/funaudiochat.py`, as well as the `Qwen2VLConfig.from pretrained()` function used by `Tarsier2ProcessingInfo` in `vllm/model executor/models/qwen2 vl.py`. Consequently, deployments pinned to a specific revision may still load processor, tokenizer, and configuration artifacts from the repository's default revision, allowing upstream changes to the default branch to alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without the operator's knowledge. **Recommendations** Update vLLM to version 0.28.0.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.29.0 **Description** A denial-of-service issue exists in OpenAI-compatible and Anthropic API endpoints. The `cache salt` parameter lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP requests containing salt values of several hundred megabytes, triggering expensive pickle serialization and SHA-256 hashing. This process stalls the scheduler thread, denying service to all concurrent requests. Real-world incidents of this issue being exploited have been reported. **Recommendations** Update to version 0.29.0 or later. As a temporary mitigation, restrict or avoid using the `cache salt` parameter in API requests.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.28.0 **Description** The software fails to validate the lower bound of token IDs in the '/v1/embeddings' and '/pooling' endpoints. This allows unauthenticated attackers to crash the engine by submitting negative token IDs. A single request containing a negative token ID triggers a CUDA device-side assertion, which poisons the GPU context and causes all subsequent requests to fail until the process is restarted. **Recommendations** Update vLLM to version 0.28.0 or later. Avoid submitting negative values to the token ID parameter in the '/v1/embeddings' and '/pooling' endpoints.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.28.0 **Description** A remote code execution issue exists in the LlavaOnevision2 processor loader. The loader ignores the `trust remote code` parameter when loading remote processor classes, allowing a malicious model containing arbitrary code in `processing llava onevision2.py` to execute with the authority of the vLLM process during processor import or initialization, even if `trust remote code` is set to False. **Recommendations** Upgrade to version 0.28.0.

**Name of the Vulnerable Software and Affected Versions** vLLM versions 0.10.2 through 0.27.9 **Description** NanoNemotronVL models fail to apply audio decode-size or duration limits when extracting audio from video input. In the file `nano nemotron vl.py`, the function ` extract audio from videos()` calls `load audio pyav()` without specifying the `max duration s` or `max decode bytes` parameters. Consequently, the limits defined by `VLLM MAX AUDIO DECODE DURATION S` and `VLLM MAX AUDIO DECODE BYTES` are not enforced. When a model is served with `use audio in video` set to `True`, an attacker can provide a small, highly compressed video as multimodal input to force the server to allocate excessive memory during audio decoding, leading to a denial of service. **Recommendations** Update vLLM to version 0.28.0. As a temporary mitigation, set `use audio in video` to `False` when serving NanoNemotronVL models.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.28.0 **Description** Authenticated clients can bypass duration checks in the transcription endpoint because the system fails to validate audio sample rate headers. By submitting forged FLAC headers with inflated sample rates, an attacker can trigger excessive memory allocation, leading to a crash of the API server process that affects all tenants. **Recommendations** Update to version 0.28.0 or later.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.27.0 **Description** The software fails to properly classify DeepStream as a GPU backend, which leads to the omission of pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream during a request to initialize the process-wide GPU decode pool and submit video content that bypasses resource controls, resulting in a partial denial of service for concurrent requests. **Recommendations** Update vLLM to version 0.27.0 or later.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: إصدارات vLLM من 0.1.0 حتى 0.10.1.0 الوصف: vLLM هو آلية استدلال وخدمة للنماذج اللغوية الكبيرة (LLMs). يمكن إحداث ثغرة أمنية من نوع «رفض الخدمة» (DoS) عن طريق إرسال طلب HTTP GET واحد مع رأس (header) كبير جدًا إلى نقطة نهاية HTTP، مما يؤدي إلى استنفاد ذاكرة الخادم واحتمال حدوث أعطال أو تعطل الخدمة. لا يتطلب الهجوم مصادقة، مما يجعله قابلاً للاستغلال من قبل أي مستخدم عن بُعد. تستغل هذه الثغرة إساءة استخدام رؤوس HTTP، مثل رأس `X-Forwarded-For`، من خلال تعيين قيمة كبيرة جدًا له. التوصيات: قم بالتحديث إلى الإصدار 0.10.1.1 من vLLM أو أحدث. استخدم وكيلًا أمام vLLM يوفر الحماية من هذه المشكلة.