Jiapeng Li

A code injection issue exists in the ` evaluate filter()` function. Remote attackers can execute Python code by escaping the `eval()` sandbox using `re.search globals `. This is possible by sending a crafted filter expression to the unauthenticated '/dumper/configure' endpoint when the `DUMPER SERVER PORT` variable is set, which results in code execution within the scheduler process during the subsequent forward pass.

An unauthenticated attacker can cause a denial of service by sending a request to the '/generate' endpoint containing the `pd kv trans params` field. This triggers a failure in the `pickle.loads` function within `InferSamplingParams`, which crashes the inference thread. While the '/health' endpoint remains operational, all subsequent requests will hang until the system is restarted.

A decompression amplification issue exists in the `load audio()` function. Remote attackers can cause a denial of service by submitting highly compressed audio files, such as small FLAC-encoded silence files, which are decoded without duration or sample limits. This process expands the files into massive PCM (Pulse Code Modulation) buffers, exhausting worker memory and CPU resources. The attack can be executed via the `audio url` or `audio data` inputs.

An unbounded memory allocation issue exists that allows unauthenticated remote attackers to cause a denial of service. By uploading oversized files to the '/v1/audio/transcriptions' endpoint, attackers can send concurrent large multipart uploads that are read entirely into memory before validation, resulting in a crash of the HTTP/tokenizer worker.

An unbounded memory allocation issue exists in the `preprocess video` function within `qwen vl.py`. The system decodes video frames at their full source resolution before applying `max pixels` limits. Remote attackers can exploit this by submitting high-resolution videos to the '/v1/chat/completions' endpoint on Qwen-VL deployments. Concurrent requests of this nature can exhaust worker memory, leading to a denial of service.

A resource budget bypass allows remote attackers to override GLM-V video processing limits. By providing specific values in the `video url` object, attackers can manipulate the `fps`, `max frames`, `max tokens per frame`, and `max image tokens` variables. This causes the `glm4v.py` function to decode every frame of high-resolution video at full size, leading to worker memory exhaustion and a denial of service.

A denial of service issue exists where the `NanoNemotronVLImageProcessor` disables Pillow decompression bomb protection process-wide by setting `Image.MAX IMAGE PIXELS` to `None`. This allows remote attackers to submit small, highly compressed images with massive dimensions to the generic image loader, leading to worker memory exhaustion during the decoding process. A decompression bomb is a malicious archive or image file designed to crash a system by expanding to an enormous size when decompressed.

Multimodal endpoints fail to validate the `image url` and `audio url` parameters, enabling unauthenticated attackers to conduct server-side request forgery (SSRF). This occurs when attackers provide arbitrary URLs to fetch internal resources, which can lead to the disclosure of content via vision model processing or the revelation of internal network topology through error responses.

The router profiler service contains a flaw that allows remote code execution when the application is started with the `--enable profiling` flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled. An attacker can execute arbitrary code by sending crafted serialized objects to the profiler command queue. Pickle deserialization is a process where a Python object is converted from a byte stream back into an object, which can be exploited to run malicious commands if the input is not trusted.

A memory exhaustion issue exists in the NCCL control channel when the software is started with the `--pd trans mode nccl` configuration. Unauthenticated attackers can exploit this by calling the `exposed set value()` method to store an unlimited number of key-value pairs without size restrictions. This action exhausts the memory of the KV-transfer worker, leading to a process crash and subsequent node failure.

Multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. This allows attackers to send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges. Pickle deserialization is a process where a Python object is converted from a byte stream back into an object, which can be exploited if the input is untrusted.

When operating in prefill/decode disaggregation mode with the Mooncake KV transfer backend, the software fails to validate duplicate `bootstrap room` fields in the '/generate' endpoint. Unauthenticated attackers can send concurrent requests using identical `bootstrap room` values, which can lead to the crashing of scheduler processes or cause other users' requests to hang until a transfer timeout occurs.

Remote code execution is possible in the KV-transfer worker when the service is started with the `--pd trans mode nccl` configuration. This configuration exposes an unauthenticated RPyC control channel via an RPyC ThreadedServer that deserializes attacker-supplied data. An attacker can send malicious pickled objects—serialized Python objects—to this channel to execute arbitrary code with the privileges of the LightLLM service account.

The Mooncake connector fails to properly manage GPU KV cache block ownership during prefill/decode disaggregated deployments when concurrent child requests share a single transfer ID. An attacker can cause GPU memory exhaustion by submitting completion requests containing multiple prompts. This action leads to the accumulation of orphaned KV cache blocks—memory blocks that are no longer associated with an active request but are not released—which persist until the process is restarted, eventually blocking legitimate requests from executing.

A denial of service issue exists in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. An attacker can send requests containing incomplete `kv transfer params` dictionary entries, which triggers an uncaught KeyError during EngineCore scheduling. This results in the termination of the decode engine, causing all routed requests to fail until the system is manually restarted.

A denial of service issue exists in the NIXL connector's prefix caching implementation within prefill/decode disaggregated deployments. The system fails to properly validate block counts when processing multi-prompt completion requests. An attacker can cause the decode worker to terminate and remain unavailable until a restart occurs by submitting completion requests containing multiple prompts of varying lengths, which triggers an assertion failure in the `NixlBaseConnectorWorker. apply prefix caching()` function.

A denial of service issue exists in P2P KV offloading when the OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. An attacker can provide arbitrary remote host and port values via the `kv transfer params` parameter to create unreachable peer sessions. These sessions retain ZeroMQ sockets until the context quota is exhausted, leading to an uncaught ZMQError that crashes EngineCore and halts all inference operations.

A resource exhaustion issue exists in the `MooncakeConnector` component. Rejected prefill requests generate ownerless transfer placeholders that are not reclaimed by the system. An attacker can exploit this by sending rejected requests to exhaust sender task pools, which results in valid requests being delayed by up to 480 seconds. During this state, health checks continue to report success, masking the issue.

OpenAI-compatible completion endpoints fail to validate the `tp size` parameter within `kv transfer params`. In prefill/decode disaggregated deployments, an attacker can provide arbitrary values for `tp size` to allocate unbounded memory, which can exhaust system resources and trigger a kernel OOM-kill (Out-Of-Memory kill, a process where the operating system terminates a process to free up memory) of the decode worker process.

A memory corruption issue exists in the Triton ` bincount kernel` function. The problem occurs when prompt token IDs index the penalty prompt-presence bitset without performing bounds checking against the vocabulary size. An attacker can exploit this by submitting multimodal audio requests containing tokens equal to the vocabulary size, leading to out-of-bounds writes. This action corrupts the sampler state of concurrent requests and alters the repetition penalty behavior.