CVE Vulnerability Catalog

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, _unpack_2bit() and _unpack_4bit() resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying that raw_data or int32_data encodes the declared number of elements. Materializing an untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 tensor through onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator can therefore expand a small packed payload into a disproportionately large allocation and exhaust memory.

ONNX versions from 1.4.0 until 1.22.0 do not safely validate the required num_scan_inputs attribute in ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9. A missing attribute is dereferenced as a null pointer, while a negative value is converted to size_t and can reach an oversized allocation path. An untrusted model can terminate or disrupt shape inference, including a negative-value model that passes onnx.checker.check_model().

ONNX versions from 1.2.1 until 1.22.0, during ConvTranspose shape inference, process a weight tensor with fewer than three dimensions without a kernel_shape attribute by deriving an empty effective_kernel_shape and indexing it for spatial dimensions. An untrusted model that passes onnx.checker.check_model() can crash onnx.shape_inference.infer_shapes(), causing denial of service without confidentiality or integrity impact.

ONNX before 1.22.0, in RNNShapeInference_opset1_to_6(), processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The function accesses dim(0) and dim(1) on an undersized protobuf shape, which can read outside the intended repeated field and terminate an application when onnx.shape_inference.infer_shapes() processes an untrusted model.

vLLM from 0.16.0 until 0.32.0 allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is configured. ChatParams.get_apply_chat_template_kwargs() preserves that value without enforcing trust_request_chat_template, bypassing the trust policy and causing CPU or memory exhaustion through Jinja rendering.

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on localhost, an internal network, or a VPN, call endpoints including GET /v1/models and POST /v1/chat/completions, consume GPU resources, and read responses. This issue is fixed in version 0.32.0.

vLLM before 0.32.0, in vllm/tokenizers/hf.py, computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For tensor-parallel size one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it, causing a CUDA device-side assertion and terminating the engine.

Prior to 0.32.0, vLLM's ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can dispatch an EPS payload to host components; a host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers.

vLLM from 0.11.1 until 0.32.0, in the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path, allows a remote client reaching the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when alone in its per-step encoder batch. _parse_and_validate_image_input returns no embedding, embed_multimodal propagates that value, and sanity_check_mm_encoder_outputs triggers a fatal assertion that shuts down the engine for all users.

HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

The Customer Coupons for WooCommerce plugin by VillaTheme has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions through 1.3.14.

The Photo Reviews for WooCommerce plugin (up to version 1.2.31) contains a race condition vulnerability due to improper synchronization of shared resources. This may allow an attacker to exploit race conditions for unauthorized actions.

There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with service access privileges to issue database-specific functions that should not be allowed.

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key.

HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent.

HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission.

A vulnerability in the Burrito Kubernetes operator (Terraform Automation Collaboration Software) prior to 0.13.0 allows the POST /api/webhook endpoint to accept unsigned GitHub and GitLab events when a TerraformRepository's credentials omit webhookSecret or set it to an empty value. Anyone who can reach the burrito-server endpoint and knows a tracked repository's URL can forge events to create or delete TerraformPullRequest custom resources with attacker-chosen Branch, Base, and ID fields. For GitHub pull_request events, the controller fetches changed files using the real pull request number but does not cross-check the payload's branch, potentially causing an unauthorized terraform plan using the operator's stored git and cloud credentials.

The Espressif AES driver (crypto_esp32_aes.c) advertises a multi-session cipher API, but the AES hardware has a single chip-global set of key and mode registers. The key is programmed only once at session start, outside the mutex, so subsequent operations may run with another session's key, causing data to be encrypted or decrypted under the wrong key without any error being reported.

A vulnerability in the Zephyr Bluetooth Classic stack affects the Hands-Free Profile Audio Gateway role. When bt_rfcomm_dlc_connect() fails after SDP discovery starts, bt_hfp_ag_connect() memset()s the entire AG object while the SDP node is still linked and ag->slc_work may still be queued. Later SDP request-list processing dereferences the zeroed pool, uuid and func pointers, causing a crash or hang of the Bluetooth stack.

A vulnerability in the Zephyr Bluetooth stack affects bt_hfp_hf_connect(), which wipes the entire HFP Hands-Free object when bt_rfcomm_dlc_connect() fails, even though the associated SDP discovery is still outstanding. This leads to use-after-free, including NULL pointer dereferences and a self-referential SDP request list, causing a fault or unrecoverable hang in the Bluetooth host thread. The flaw is remotely reachable, e.g., via a device advertising an RFCOMM channel outside 1-30 or controlling connection timing.