A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

python313-vllm-0.30.0-1.1 on GA media

Cohere North AI: Cohere North AI: Arbitrary user information overwrite via incorrect access control Cohere North AI: Cohere North AI: Information disclosure via improper Origin header validation Cohere North AI: Cohere North AI: Information Leak via WebSocket Endpoint urllib3: urllib3 Streaming API improperly handles highly compressed data python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting fast-uri: fast-uri: URI authority bypass due to improper delimiter handling undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite urllib3: urllib3: Denial of Service via decompression bomb bypass with Brotli support org.eclipse.parsson/parsson: Eclipse Parsson: Denial of Service via uncontrolled resource consumption in JSON parsing undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 form-data: form-data: Form field override via CRLF injection undici: undici: Denial…