https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 23:17:38 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-105759 <p>vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend&#39;s track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus&#39;s Family::get_or_create function to permanently create counter and histogram label sets. Those label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted. This issue is fixed in version 0.30.0.</p> <p>vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend&#39;s track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus&#39;s Family::get_or_create function to permanently create counter and histogram label sets. Those label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted. This issue is fixed in version 0.30.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-105759