Jiajia Liu

Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails.

When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.

SGLang with the Mooncake disaggregation backend allows denial of service when it accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket. Network-adjacent attackers can exhaust Prefill memory, leading to the scheduler being OOM-killed (Out-Of-Memory killed, a process where the operating system terminates a process to free up memory), by sending numerous registrations containing large nested-buffer frames and unique `mooncake session id` values.

An authorization bypass exists where holders of the data-plane API key can access mesh High Availability (HA) management routes. This occurs because the `/ha/*` endpoints skip control-plane Admin role checks. An attacker can read cluster topology, write gossiped configuration, modify global rate limits, and use the `POST /ha/shutdown` endpoint to silently dissolve HA coordination.

An uncontrolled memory allocation issue exists in the Mooncake disaggregation backend within the `handle staging rsp()` function. Unauthenticated network-adjacent attackers can exhaust Prefill memory by obtaining the rank address from the '/route' endpoint and sending STAGING RSP messages containing excessively large `chunk idx` values under new room IDs. This action can lead to the scheduler being OOM-killed, which refers to an Out-Of-Memory state where the operating system terminates the process to reclaim memory.

In prefill/decode disaggregation mode, a server-side request forgery issue exists that allows unauthenticated attackers to trigger outbound requests. By sending crafted requests to the '/generate' endpoint of the Decode worker, attackers can use the `bootstrap host` and `bootstrap port` fields to probe internal hosts and ports. This action can block the shared scheduler loop, resulting in delays for other inference requests.

A denial of service issue exists where API clients can abort in-flight generation requests belonging to other users. This occurs when an attacker submits streaming requests to the '/generate' endpoint using a short, client-controlled `rid` (request identifier). By using single hex character `rid` values and then disconnecting, the attacker triggers prefix-matching abort logic that terminates all other active client requests.

A code injection issue exists in the ` evaluate filter()` function. Remote attackers can execute Python code by escaping the `eval()` sandbox using `re.search globals `. This is possible by sending a crafted filter expression to the unauthenticated '/dumper/configure' endpoint when the `DUMPER SERVER PORT` variable is set, which results in code execution within the scheduler process during the subsequent forward pass.

The software trusts caller-supplied `mm hashes` values as the multimodal prefix-cache key. This allows remote attackers to poison cached KV (Key-Value) entries across requests. By sending a different image under a known or predicted hash via the '/generate' endpoint, an attacker can disclose the image content of another request or corrupt the responses received by victims.

An unauthenticated attacker can cause a denial of service by sending a request to the '/generate' endpoint containing the `pd kv trans params` field. This triggers a failure in the `pickle.loads` function within `InferSamplingParams`, which crashes the inference thread. While the '/health' endpoint remains operational, all subsequent requests will hang until the system is restarted.

An unbounded memory allocation issue exists that allows unauthenticated remote attackers to cause a denial of service. By uploading oversized files to the '/v1/audio/transcriptions' endpoint, attackers can send concurrent large multipart uploads that are read entirely into memory before validation, resulting in a crash of the HTTP/tokenizer worker.

A decompression amplification issue exists in the `load audio()` function. Remote attackers can cause a denial of service by submitting highly compressed audio files, such as small FLAC-encoded silence files, which are decoded without duration or sample limits. This process expands the files into massive PCM (Pulse Code Modulation) buffers, exhausting worker memory and CPU resources. The attack can be executed via the `audio url` or `audio data` inputs.

A resource budget bypass allows remote attackers to override GLM-V video processing limits. By providing specific values in the `video url` object, attackers can manipulate the `fps`, `max frames`, `max tokens per frame`, and `max image tokens` variables. This causes the `glm4v.py` function to decode every frame of high-resolution video at full size, leading to worker memory exhaustion and a denial of service.

A denial of service issue exists where the `NanoNemotronVLImageProcessor` disables Pillow decompression bomb protection process-wide by setting `Image.MAX IMAGE PIXELS` to `None`. This allows remote attackers to submit small, highly compressed images with massive dimensions to the generic image loader, leading to worker memory exhaustion during the decoding process. A decompression bomb is a malicious archive or image file designed to crash a system by expanding to an enormous size when decompressed.

An unbounded memory allocation issue exists in the `preprocess video` function within `qwen vl.py`. The system decodes video frames at their full source resolution before applying `max pixels` limits. Remote attackers can exploit this by submitting high-resolution videos to the '/v1/chat/completions' endpoint on Qwen-VL deployments. Concurrent requests of this nature can exhaust worker memory, leading to a denial of service.

The multiprocess coordinator lacks authentication, allowing remote unauthenticated attackers to access the HTTP fleet control API, which listens on all interfaces by default. Attackers can use the '/instances' endpoint to register or deregister instances, the '/quota' endpoint to overwrite quotas, and the '/events' endpoint to inject events. Additionally, they can enumerate '/directory/keys' to disclose placement metadata and disrupt caching.

The multiprocess mode HTTP server lacks authentication, allowing remote unauthenticated attackers to access management endpoints that listen on all interfaces by default. This allows attackers to read environment credentials via the 'GET /env' endpoint and configuration via the 'GET /config' endpoint. Additionally, attackers can clear caches, delete cache objects, and modify tenant quotas to evict cached data belonging to other tenants.

The frontend monitoring service contains a server-side request forgery (SSRF) issue. Unauthenticated attackers can bypass the proxy allowlist by registering arbitrary hosts through the 'POST /api/proxies' endpoint. Subsequently, the '/proxy' or '/proxy2' endpoints can be used to access internal hosts, read responses, tamper with nodes, or stop the heartbeat.

An unauthenticated remote code execution issue exists where remote attackers can execute Python code by sending scripts to the '/run script' endpoint. By leveraging the injected FastAPI app object, attackers can recover real builtins to bypass the guarded ` import ` function, allowing them to import the `os` module and execute operating system commands with the privileges of the LMCache process.

A missing authorization issue allows unauthenticated attackers to inject completed LOCAL DISK replicas via the `NotifyOffloadSuccess` RPC. By mounting a local disk segment with a self-chosen client UUID, an attacker can attach replicas that point to endpoints under their control. This enables the delivery of poisoned disk-tier reads and the simulation of fake key existence.