CVE Vulnerability Catalog

In vLLM before 0.30.0, a caller can use the media_io_kwargs field to select the GLMGA video backend and supply large fps and max_frames values without a strict work ceiling, causing disproportionate CPU and memory consumption.

In vLLM before 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label, allowing an unauthenticated attacker to send unique arbitrary method tokens and cause permanent creation of label sets, increasing memory usage.

In vLLM from 0.24.0 to 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for max_frames and fps without server-side ceilings, allowing an unauthenticated caller to decode every frame from attacker-controlled video and consume disproportionate memory.

In vLLM before 0.30.0, structured-output request failures can escape validation and reach the EngineCore fatal-error path, allowing ordinary constrained-generation requests to terminate the shared engine.

In vLLM before 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing character and length restrictions, which can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate.

In vLLM before 0.30.0, flash late-interaction scoring at /score and /rerank derives query_key from the caller-controlled X-Request-Id header, allowing a concurrent request to overwrite the cached query embedding of a victim.

In vLLM before 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors, cache identifiers, ranges, and wire-selected multimodal field processors without rebinding them to the active model renderer contract, which can terminate EngineCore, poison cache, or alter transport semantics.

In vLLM before 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during rendering and before engine admission, while the receiver cache never receives the payload if the request is rejected, causing an assertion error on later reuse.

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.

In Docling from 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed.

In Docling from 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends accept rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can cause sustained CPU use or multi-gigabyte memory allocation.

In Docling from 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend does not reject picture image references containing local paths or file URIs. When the document is enriched or exported with ImageRefMode.EMBEDDED, DoclingDocument methods can open those references and place readable image bytes in Markdown or HTML output.

In Docling from 2.45.0 until 2.131.0, METS-GBS format detection and the backend call tarfile.TarFile.getmembers() before enforcing the max_member_count limit, causing the full archive member list to be allocated before the limit can stop processing. A small gzip-compressed tar archive with a very large number of empty members can consume memory proportional to the declared member count.

In Docling from 2.27.0 until 2.131.0, plugin factories call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every module registered in the Docling entry-point group is imported even when external plugins are disabled. An installed malicious package can execute import-time code when Docling starts.

In Docling from 2.91.0 until 2.132.0, validate_url_safety validates a hostname with a single IPv4 lookup and then allows the HTTP client to resolve and parse the original URL again, permitting DNS rebinding, mixed public and internal address records, and backslash authority parser disagreement to reach internal services. HTMLBackendOptions(render_page=True) also allows HTTP and HTTPS browser requests without validating their resolved destination.

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation.

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation.

In AMD Versal Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in arbitrary code execution during boot process. This condition could lead to potential impacts on confidentiality, integrity, and availability.

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, for example based on commit SHA, commit data, or signatures, then all these validations still apply correctly.