vLLM: Completion prompt lists fan out into unbounded engine requests
CVE-2026-73559
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions Complet
#cwe-400
共收录 1383 条相关情报。
← 返回所有主题vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574
CVE-2026-73556
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex paramet
Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and...
CVE-2026-73413
Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop i
Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation.
CVE-2026-19587
Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation.
Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the ...
CVE-2026-73228
Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() a...
CVE-2026-73216
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in sr
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/apps/relay/turn_ports.c marks the unused odd sibling port ...
CVE-2026-73215
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/a
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtls_server_input_handler() and create_new_connected_udp_socket() in src/apps/relay/dtls_li...
CVE-2026-73214
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtls_server_input_handler() and cr
coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS
CVE-2026-73214
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtls_server_input_handler() and cr
Uncontrolled resource consumption in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network.
CVE-2026-65785
Uncontrolled resource consumption in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacen
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulner...
CVE-2026-48443
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulner...
CVE-2026-48439
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulner...
CVE-2026-48434
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application
Uncontrolled resource consumption for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Unprivileged software ...
CVE-2026-20780
Uncontrolled resource consumption for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Driv
CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side ...
CVE-2026-72912
CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-rec
Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thr...
CVE-2026-44630
Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to caus
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST A...
CVE-2026-52880
Klever-Go 是 Klever 区块链协议的 Go 实现，其 REST API 使用 Gin 框架的 `Engine.Run` 便捷方法启动。该方法依赖于 Go 标准库的 `http.Server`，但未设置 `ReadHeaderT
Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every inco...
CVE-2026-52879
Klever-Go是Klever区块链协议的Go实现。在版本1.7.14至1.7.17中，其直接消息入口处理器在处理每个传入的直接消息时，会在处理器层面的防洪水层做出接纳决定之前，就为每条消息新建一个goroutine，且没有信号量、节流器
Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw tha...
CVE-2026-49343
Klever-Go 是 Klever 区块链协议的 Go 实现。在 1.7.18 版本之前，其账户数据 trie 同步器存在一个资源耗尽漏洞，会在错误路径上泄漏有界节流器的槽位。具体而言，在 syncDataTrie() 函数（位于 use
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A conne...
CVE-2026-47249
CVE-2026-47249 是 Klever-Go（Klever 区块链协议的 Go 实现）中存在于 1.7.18 之前版本的一个远程拒绝服务漏洞。漏洞根因在于 P2P 解析器（resolver）的请求处理逻辑未能有效限制解码后的哈希条目