[Git][security-tracker-team/security-tracker][master] Add new vllm issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
9ff68ba6 by Salvatore Bonaccorso at 2026-09-26T22:04:46+02:00
Add new vllm issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -188,21 +188,21 @@ CVE-2026-100656 (Netty (io.netty:netty-codec-http) contains an unbounded per-con
 CVE-2026-100655 (Netty (io.netty:netty-codec-http) versions up to and including 4.1.137 ...)
 	TODO: check
 CVE-2026-100654 (vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenA ...)
-	TODO: check
+	- vllm <itp> (bug #1095237)
 CVE-2026-100653 (vLLM is an inference and serving engine for large language models. In  ...)
-	TODO: check
+	- vllm <itp> (bug #1095237)
 CVE-2026-100652 (vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids ag ...)
-	TODO: check
+	- vllm <itp> (bug #1095237)
 CVE-2026-100651 (vLLM before 0.29.0 fails to enforce decoder prompt-length validation o ...)
-	TODO: check
+	- vllm <itp> (bug #1095237)
 CVE-2026-100650 (vLLM through 0.29.0 fetches and fully materializes remote or inline me ...)
-	TODO: check
+	- vllm <itp> (bug #1095237)
 CVE-2026-100649 (vLLM before 0.29.0 contains a resource-limit bypass vulnerability in P ...)
-	TODO: check
+	- vllm <itp> (bug #1095237)
 CVE-2026-100648 (vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB li ...)
-	TODO: check
+	- vllm <itp> (bug #1095237)
 CVE-2026-100647 (vLLM versions before 0.29.0 contain a denial-of-service vulnerability  ...)
-	TODO: check
+	- vllm <itp> (bug #1095237)
 CVE-2026-100646 (SiYuan is a self-hosted personal knowledge management system. In versi ...)
 	NOT-FOR-US: SiYuan
 CVE-2026-100645 (SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripti ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ff68ba6c15db183f4d675d947d3d881d025e48a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ff68ba6c15db183f4d675d947d3d881d025e48a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260926/16997642/attachment.htm>