Mschwarzl

A server-side request forgery issue allows API callers to force outbound connections by embedding a decode address in the `X-Request-Id` header. This can lead to a P2pNcclConnector prefill worker performing a ZMQ-connect to an attacker-controlled host, resulting in the leakage of the NCCL `unique id` and KV-cache tensors, or causing the worker to be blocked.

Unauthenticated attackers can cause memory exhaustion because Nemotron-VL processors globally set `Image.MAX IMAGE PIXELS` to None. By submitting a pathological decompression-bomb image to the '/v1/chat/completions' endpoint, an attacker can trigger an Out-Of-Memory (OOM) kill of the worker, resulting in a denial of service for other tenants.

Improper input validation allows remote attackers to crash the engine or cause a write operation outside the V2 runner's logits buffer. This occurs when out-of-vocabulary `stop token ids` are supplied via OpenAI chat, completion, generate, or batch requests.

The Cloudflare version of the zlib library was found to have memory corruption issues due to improper input validation and heap-based buffer overflow in the deflation algorithm implementation. A local attacker could exploit this issue during compression using a crafted malicious file, potentially leading to denial of service.