CWE-400

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@ai-sdk/provider-utils"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.28"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@ai-sdk/provider-utils"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-beta.10"
            },
            {
              "fixed": "4.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@ai-sdk/provider-utils"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-beta.0"
            },
            {
              "fixed": "5.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-8769"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T16:18:57Z",
    "nvd_published_at": "2026-05-17T23:17:03Z",
    "severity": "LOW"
  },
  "details": "Versions of `@ai-sdk/provider-utils` before 3.0.28, from 4.0.0 before 4.0.33, and from 5.0.0 before 5.0.1 are vulnerable to uncontrolled resource consumption. The `createJsonResponseHandler`, `createJsonErrorResponseHandler`, and `createStatusCodeErrorResponseHandler` functions in `packages/provider-utils/src/response-handler.ts` read response bodies without a shared size limit, allowing a remote attacker with low privileges to cause excessive memory consumption. The exploit has been publicly disclosed and may be utilized.",
  "id": "GHSA-866g-f22w-33x8",
  "modified": "2026-09-08T16:16:50Z",
  "published": "2026-05-18T00:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8769"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/ai/pull/16374"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/ai/commit/6a436e31d247d678ddaedfc6f61e73ac0595e4b4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/ai/commit/b30e43ac3fae2432a40b4f4f27f844f3d78b119e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/ai/commit/b85c4fbc603b8173cf50a9790823397aada908a9"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/YLChen-007/fb1096bc8428bed9a428f764d9d103bb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vercel/ai"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/ai/blob/main/packages/provider-utils/CHANGELOG.md#501"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@3.0.28"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@4.0.33"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@5.0.1"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/811406"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/364394"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/364394/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-3195"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-05-06T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the Open Shortest Path First (OSPF) implementation in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. The vulnerability is due to incorrect processing of certain OSPF packets. An attacker could exploit this vulnerability by sending a series of crafted OSPF packets to be processed by an affected device. A successful exploit could allow the attacker to continuously consume memory on an affected device and eventually cause it to reload, resulting in a denial of service (DoS) condition.",
  "id": "GHSA-868c-7v9p-gmxp",
  "modified": "2023-08-16T18:30:18Z",
  "published": "2022-05-24T17:17:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3195"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-ospf-memleak-DHpsgfnv"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-plugin-channel-export"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-43105"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-23T21:17:09Z",
    "nvd_published_at": "2024-08-23T08:15:04Z",
    "severity": "MODERATE"
  },
  "details": "Mattermost Plugin Channel Export versions \u003c=1.0.0 fail to restrict concurrent runs of the /export command which allows a user to consume excessive resource by running the /export command multiple times at once.",
  "id": "GHSA-869f-px86-vj84",
  "modified": "2024-08-23T21:17:09Z",
  "published": "2024-08-23T09:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43105"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost-plugin-channel-export/commit/bb6da1f6bedd6cefe2276d6493b5541843c543a6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mattermost/mattermost-plugin-channel-export"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mattermost Plugin Channel Export excessive resource consumption"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "url-relative"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-06-05T13:46:47Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "All versions of `url-relative` are vulnerable to Denial of Service. If the values `to` and `from` are equal, the function hangs and never returns. This may cause a Denial of Service.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative module until a fix is made available.",
  "id": "GHSA-86p3-4gfq-38f2",
  "modified": "2021-08-04T21:31:03Z",
  "published": "2019-06-05T14:10:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/junosuarez/url-relative/issues/3"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-URLRELATIVE-173691"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/783"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Denial of Service in url-relative"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-9280"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-20T14:16:09Z",
    "severity": "HIGH"
  },
  "details": "A security issue exists within ArmorStart\u00ae LT that can result in a denial-of-service condition. Fuzzing performed using Defensics causes the device to become unresponsive, requiring a reboot.",
  "id": "GHSA-86vj-4572-h8w4",
  "modified": "2026-02-02T18:31:31Z",
  "published": "2026-01-20T15:33:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9280"
    },
    {
      "type": "WEB",
      "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1768.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-41568"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-29T05:15:00Z",
    "severity": "HIGH"
  },
  "details": "LINE client for iOS before 12.17.0 might be crashed by sharing an invalid shared key of e2ee in group chat.",
  "id": "GHSA-8736-x895-x6jp",
  "modified": "2022-12-02T18:30:29Z",
  "published": "2022-11-29T06:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41568"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1701642"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vllm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71486"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-04T21:32:07Z",
    "nvd_published_at": "2026-08-17T20:16:45Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `/v1/completions/derender` and `/v1/chat/completions/derender` endpoints accept caller-supplied `GenerateResponse` objects and postprocess every nested `choices[*].token_ids` list directly. Unlike the normal render/generate path, derender does not enforce model context length, resolved `max_tokens`, `max_num_seqs`, choice-count, or response-size bounds before detokenizing and returning the supplied token IDs. An authenticated API client can therefore make the CPU-only render frontend, or any server exposing these `/v1` derender routes, spend CPU and memory proportional to attacker-chosen generated-output-shaped JSON rather than to a bounded generation result.\n\n## Technical Details\n\nThe render router registers `/v1/chat/completions/derender` and `/v1/completions/derender` in `vllm/entrypoints/serve/render/api_router.py`, and the OpenAI API server attaches this router whenever `\"generate\"` or `\"render\"` is in `supported_tasks` (`vllm/entrypoints/openai/api_server.py`). The routes are under `/v1`, so they are part of the OpenAI-compatible HTTP API surface and are protected by the API-key middleware when `--api-key` is configured.\n\nThe request types trust generated-output-shaped data from the client. In `vllm/entrypoints/serve/disagg/protocol.py`, `GenerateResponseChoice` accepts `token_ids: list[int] | None = None`, `GenerateResponse` accepts `choices: list[GenerateResponseChoice]`, and `DerenderCompletionRequest` accepts `generate_responses: list[GenerateResponse]`. These fields have no max length, max item count, or relationship to a prior `GenerateRequest`.\n\nThe sink is `OnlineDerenderer`. `derender_completion()` iterates every supplied `generate_responses` entry and every nested choice, calls `tokenizer.decode(choice.token_ids, skip_special_tokens=True)`, appends the decoded text to the response choices, and increments `total_completion_tokens` from the same supplied list length. `derender_chat()` has the same shape for a single supplied `generate_response`, and can also feed the decoded text into tool/reasoning parsers when a parser and `chat_request` are present. `ServingRender.derender_completion_response()` calls `online_derenderer.derender_completion(request.generate_responses, request.prompt_tokens)` before applying any completion-level validation beyond the model check.\n\nNormal render and generation paths derive output limits from `max_model_len`, the rendered prompt length, request `max_tokens` / `max_completion_tokens`, and scheduler limits. Derender bypasses that invariant because it accepts the already-generated output shape directly from the HTTP caller. The missing invariant is: derender should only postprocess bounded generated output, and client-supplied derender payloads must be rejected if their nested generated token/logprob structures exceed the same limits that generation would have enforced.\n\n## PoV\n\nThe following bounded PoV can be run from a current vLLM checkout containing PR `#43606`. It asserts the current source facts for the derender routes, unchecked request fields, and decode sink, then simulates the same derender loop with a counting tokenizer. The negative control is a one-choice, 32-token response. The amplified payload keeps the test bounded but demonstrates that all decoded work and returned text scale directly with caller-supplied `GenerateResponse` contents.\n\n```python\n#!/usr/bin/env python3\nimport subprocess\nfrom dataclasses import dataclass\nfrom pathlib import Path\n\nSOURCE = Path(\".\")\n\ndef require_source_fact(path: str, needles: list[str]) -\u003e None:\n    text = (SOURCE / path).read_text()\n    missing = [needle for needle in needles if needle not in text]\n    if missing:\n        raise AssertionError(f\"{path} missing expected facts: {missing}\")\n\ndef source_head() -\u003e str:\n    return subprocess.check_output([\"git\", \"rev-parse\", \"HEAD\"], cwd=SOURCE, text=True).strip()\n\n@dataclass\nclass Choice:\n    index: int\n    token_ids: list[int]\n\n@dataclass\nclass GenerateResponse:\n    request_id: str\n    choices: list[Choice]\n\nclass CountingTokenizer:\n    def __init__(self) -\u003e None:\n        self.decode_calls = 0\n        self.decoded_ids = 0\n    def decode(self, token_ids: list[int], *, skip_special_tokens: bool = True) -\u003e str:\n        self.decode_calls += 1\n        self.decoded_ids += len(token_ids)\n        return \"x\" * len(token_ids)\n\ndef derender_completion_like_current_head(generate_responses: list[GenerateResponse], tokenizer: CountingTokenizer) -\u003e tuple[int, int, int]:\n    output_chars = 0\n    choices = 0\n    total_completion_tokens = 0\n    for gen in generate_responses:\n        for choice in gen.choices:\n            if not choice.token_ids:\n                raise ValueError(\"choice has empty or null token_ids\")\n            decoded_text = tokenizer.decode(choice.token_ids, skip_special_tokens=True)\n            output_chars += len(decoded_text)\n            total_completion_tokens += len(choice.token_ids)\n            choices += 1\n    return choices, total_completion_tokens, output_chars\n\ndef make_payload(responses: int, choices_per_response: int, tokens_per_choice: int) -\u003e list[GenerateResponse]:\n    token_ids = [42] * tokens_per_choice\n    return [GenerateResponse(request_id=f\"gen-{r}\", choices=[Choice(index=c, token_ids=list(token_ids)) for c in range(choices_per_response)]) for r in range(responses)]\n\ndef run_case(name: str, payload: list[GenerateResponse]) -\u003e None:\n    tokenizer = CountingTokenizer()\n    choices, completion_tokens, output_chars = derender_completion_like_current_head(payload, tokenizer)\n    print(f\"{name}: responses={len(payload)} choices={choices} decode_calls={tokenizer.decode_calls} decoded_token_ids={tokenizer.decoded_ids} completion_tokens={completion_tokens} output_chars={output_chars}\")\n\nrequire_source_fact(\"vllm/entrypoints/serve/render/api_router.py\", [\u0027\"/v1/completions/derender\"\u0027, \u0027\"/v1/chat/completions/derender\"\u0027, \"app.include_router(router)\"])\nrequire_source_fact(\"vllm/entrypoints/serve/disagg/protocol.py\", [\"class GenerateResponseChoice(BaseModel):\", \"token_ids: list[int] | None = None\", \"class GenerateResponse(BaseModel):\", \"choices: list[GenerateResponseChoice]\", \"class DerenderCompletionRequest(BaseModel):\", \"generate_responses: list[GenerateResponse]\"])\nrequire_source_fact(\"vllm/renderers/online_derenderer.py\", [\"async def derender_completion(\", \"for gen, pt in zip(generate_responses, prompt_tokens_list):\", \"for choice in gen.choices:\", \"decoded_text = tokenizer.decode(\", \"total_completion_tokens += len(choice.token_ids)\"])\nprint(\"source_checks=ok\")\nprint(f\"source_head={source_head()}\")\nrun_case(\"negative_control\", make_payload(responses=1, choices_per_response=1, tokens_per_choice=32))\nrun_case(\"amplified_payload\", make_payload(responses=16, choices_per_response=4, tokens_per_choice=8192))\nprint(\"observation=derender decodes every caller-supplied token id before any max_model_len, max_tokens, max_num_seqs, or response-size check\")\n```\n\n\n## Impact\n\nAn attacker with access to the `/v1` API can send derender requests that consume CPU and memory in the frontend/postprocessing process and can cause large responses unrelated to any bounded generation. In disaggregated deployments, this affects the CPU-only render frontend; in servers where the render router is attached alongside generation, it affects the same OpenAI-compatible server process that handles normal client traffic. This can degrade availability for other clients sharing the process.\n\nLikely CWE: CWE-400 (Uncontrolled Resource Consumption) / CWE-770 (Allocation of Resources Without Limits or Throttling). Conservative CVSS v3.1: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L` (4.3). This is not Low severity because a regular network API client can induce availability impact in a shared service without local access, invalid model artifacts, or special runtime privileges. If the server is deployed without API-key enforcement for `/v1`, the privileges component becomes `PR:N`.\n\n## Suggested Fix\n\nValidate derender payloads before any detokenization or parser invocation. Apply bounded limits to `generate_response(s)`, `choices`, `token_ids`, `prompt_logprobs`, `logprobs.content`, `top_logprobs`, and `routed_experts` that are at least as strict as the corresponding generation-side limits. For completions, reject `generate_responses` counts above the number of prompts that `/v1/completions/render` would have produced, and reject total nested choice counts above `max_num_seqs` / `n` limits. For each choice, reject `token_ids` longer than the resolved output-token budget, or require derender callers to submit the original bounded `GenerateRequest` / sampling metadata and validate the `GenerateResponse` against it before decoding.\n\nAdd regression tests for both derender endpoints. The tests should show that a normal bounded derender payload succeeds, while oversized `generate_responses`, oversized `choices`, oversized `token_ids`, and oversized logprob/top-logprob structures are rejected before `tokenizer.decode()` or parser execution.\n\n## Affected Package/Versions\n\nConfirmed affected: current main at `ddd3855a28a561a5bb54d380c6e6b8b1e883cc4a` and downstream/nightly builds that include the derender endpoints introduced by PR `#43606`. The derender router, request models, decode sink, render serving bridge, and OpenAI API router attachment have no relevant diff from `00e045b7c7b82599f626779e111233abd4d0a64e` to `ddd3855a28a561a5bb54d380c6e6b8b1e883cc4a`.\n\nLatest release checked: `v0.23.0`, published on `2026-06-15`. Its `vllm/entrypoints/serve/render/api_router.py` does not expose `/v1/completions/derender` or `/v1/chat/completions/derender`, so `v0.23.0` was not confirmed affected.\n\n## Advisory History\n\nPR `#43606` (\"[Render] Add `/derender` endpoints for disaggregated postprocessing\") introduced the derender endpoints on main. PR `#44285` later refactored the render serving code, and current head still contains the unchecked derender flow.\n\nPublic issue search for `derender GenerateResponse token_ids` returned no reports. Public search for `\"/v1/completions/derender\"` returned the derender feature RFC `#42729` and unrelated bugs, but no size-bound, DoS, or generated-output postprocessing issue.\n\nRelated public request-fanout and resource-bound advisories are distinct:\n\n- `GHSA-3mwp-wvh9-7528` covers an unbounded `n` parameter on the normal OpenAI completion/chat generation routes. Its root cause is missing upper-bound validation for generated sequence count, its sink is request fanout and request-object copying into the async engine path before scheduling, its precondition is a caller-controlled `n`, and its fix surface is a cap on generated sequence count. This report reaches `/v1/completions/derender` and `/v1/chat/completions/derender`, not the normal generate routes; its root cause is unchecked caller-supplied `GenerateResponse` / `choices` / `token_ids` structures, its sink is `OnlineDerenderer` detokenization and response construction after generation, its precondition is access to the derender API with generated-output-shaped JSON, and its fix surface is derender payload validation before decode.\n- PR `#45390` includes the `GHSA-83mh-6mwq-3hg9` batch-message fanout fix class: it bounds the outer `BatchChatCompletionRequest.messages` conversation list to prevent one request from creating many conversation/request objects before normal generation. This report has no batch conversation list and does not rely on `n`; one derender request can instead supply oversized nested `GenerateResponse` choices and token IDs that are detokenized and returned directly. A batch-message `max_length` limit would not bound derender `generate_response(s)` or per-choice token/logprob structures.\n\nThe completed local report titled \"Explicit truncation_side disables tokenizer-level prompt truncation\" is also distinct. That report used `/v1/completions` and `/v1/chat/completions` with ordinary prompt text plus `truncate_prompt_tokens` and explicit `truncation_side`; its root cause was the renderer omitting tokenizer-level `max_length` and the pre-tokenization character guard before post-token slicing; its sink was prompt tokenization; and its fix surface was preserving tokenizer-level truncation or rejecting over-budget prompts before tokenization. This derender report uses `/v1` derender routes, has no prompt text tokenization or truncation-side control, starts from caller-supplied generated-output token IDs, and needs aggregate bounds on derender `generate_response(s)`, choices, token IDs, logprobs, parser inputs, and response construction before detokenization.\n\nOther adjacent vLLM advisories for Rust/gRPC token-id and logprob bounds, structured-output grammar amplification, repetition-detection windows, and pooling/rerank batch fanout are distinct. Those issues affect Rust/gRPC request conversion, grammar compilation, scheduler loops, or engine fanout. This issue affects `/v1` derender postprocessing of caller-supplied generated-output objects and requires derender-specific request validation before detokenization.\n\n## Resources\n\n- `vllm/entrypoints/serve/render/api_router.py`\n- `vllm/entrypoints/serve/disagg/protocol.py`\n- `vllm/renderers/online_derenderer.py`\n- `vllm/entrypoints/serve/render/serving.py`\n- `vllm/entrypoints/openai/api_server.py`\n- PR `#43606`: `https://github.com/vllm-project/vllm/pull/43606`\n- PR `#44285`: `https://github.com/vllm-project/vllm/pull/44285`\n- `GHSA-3mwp-wvh9-7528`: `https://github.com/vllm-project/vllm/security/advisories/GHSA-3mwp-wvh9-7528`\n- PR `#45390`: `https://github.com/vllm-project/vllm/pull/45390`\n- Release `v0.23.0`: `https://github.com/vllm-project/vllm/releases/tag/v0.23.0`",
  "id": "GHSA-8737-qx52-hjff",
  "modified": "2026-09-04T21:32:08Z",
  "published": "2026-09-04T21:32:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-8737-qx52-hjff"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71486"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/pull/47260"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/commit/8e61b646e2d157f9b93451fa048f9c8530c8a67b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vllm-project/vllm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/releases/tag/v0.26.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds"
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-7285"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-03-29T14:59:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of TCP RST packets, preventing the affected router from accepting new TCP connections.",
  "id": "GHSA-8754-hm6g-jhw5",
  "modified": "2025-04-20T03:34:58Z",
  "published": "2022-05-17T02:51:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7285"
    },
    {
      "type": "WEB",
      "url": "https://cxsecurity.com/issue/WLB-2017030242"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/41752"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/97266"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-33959"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346",
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-01-18T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.",
  "id": "GHSA-8788-3qj3-84j7",
  "modified": "2023-01-26T18:30:48Z",
  "published": "2023-01-18T15:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33959"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lixiang957/CVE-2021-33959"
    },
    {
      "type": "WEB",
      "url": "https://www.freebuf.com/articles/web/260338.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-61052"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-21T22:18:36Z",
    "severity": "MODERATE"
  },
  "details": "Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).",
  "id": "GHSA-87hm-5j5g-7hm2",
  "modified": "2026-07-22T00:32:12Z",
  "published": "2026-07-22T00:32:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61052"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}