PkgSeer

Vulnerability PYSEC-2026-4186

High Risk

6 days ago

No summary available

0.0.1 - 0.26.0

Details

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 0.29.1rc0 is able to resolve this issue. This patch is called 3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9. Upgrading the affected component is advised.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

0.0.1 - 0.27.1 GHSA-ph3r-5jfg-f84f

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

0.0.1 - 0.29.0 GHSA-935w-9g4m-p28p

vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

0.24.0 - 0.29.0 GHSA-x6mc-67gf-chw4

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

0.23.0 - 0.29.0 GHSA-58v5-2m8f-94pr

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

0.0.1 - 0.29.0 GHSA-ph72-cqr5-qpp7

View all vulnerabilities for these packages

Impacted packages

vllm

Timeline

Published

6 days ago

Fixed (0.27.0)

1 month ago

Last Modified

3 hours ago