[Git][security-tracker-team/security-tracker][master] Add new vllm issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e542fd03 by Salvatore Bonaccorso at 2026-10-21T21:41:07+02:00
Add new vllm issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1543,19 +1543,19 @@ CVE-2026-114057 (ArcadeDB from 26.2.1 before 26.10.1 contains a missing authoriz
 CVE-2026-114056 (ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass v ...)
 	NOT-FOR-US: ArcadeDB
 CVE-2026-114055 (vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consum ...)
-	TODO: check
+	- vllm <itp> (bug #1095237)
 CVE-2026-114054 (vLLM before 0.31.0 contains a cache aliasing vulnerability that allows ...)
-	TODO: check
+	- vllm <itp> (bug #1095237)
 CVE-2026-114053 (vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_process ...)
-	TODO: check
+	- vllm <itp> (bug #1095237)
 CVE-2026-114052 (vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulne ...)
-	TODO: check
+	- vllm <itp> (bug #1095237)
 CVE-2026-114051 (vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /infer ...)
-	TODO: check
+	- vllm <itp> (bug #1095237)
 CVE-2026-114050 (vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as  ...)
-	TODO: check
+	- vllm <itp> (bug #1095237)
 CVE-2026-114049 (vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.co ...)
-	TODO: check
+	- vllm <itp> (bug #1095237)
 CVE-2026-114048 (WWBN AVideo before 24.0 contains a cross-site request forgery vulnerab ...)
 	NOT-FOR-US: WWBN AVideo
 CVE-2026-114047 (FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate vali ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e542fd03a8ad256f6ff2ad68a6572c67684e42b2

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e542fd03a8ad256f6ff2ad68a6572c67684e42b2
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261021/8cf1a31a/attachment-0001.htm>