Описание
A vulnerability was identified in vllm-project vllm 0.19.0. This issue affects some unknown processing of the component OpenAI-compatible Serving Path. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
A flaw was found in vllm-project vllm, specifically within its OpenAI-compatible Serving Path. A remote attacker could exploit this vulnerability by manipulating certain processing, leading to a denial of service (DoS). This could make the affected service unavailable to legitimate users. The issue impacts the availability of the vllm service.
Отчет
This Moderate-severity denial of service flaw in the vllm OpenAI-compatible Serving Path, as deployed in Red Hat AI Inference Server, Red Hat OpenShift AI, and Red Hat Enterprise Linux AI, allows a remote attacker to disrupt service availability. The vulnerability specifically impacts the ability of the vllm service to process requests, leading to a temporary outage.
Меры по смягчению последствий
To mitigate this issue, restrict network access to the vllm OpenAI-compatible Serving Path to only trusted clients and networks. Implement firewall rules to limit exposure of the service to the public internet or untrusted internal networks.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat AI Inference Server | rhaiis/vllm-cpu-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaiis/vllm-cuda-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaiis/vllm-neuron-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaiis/vllm-rocm-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaiis/vllm-spyre-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaiis/vllm-tpu-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaii/vllm-cpu-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaii/vllm-cuda-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaii/vllm-gaudi-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaii/vllm-neuron-rhel9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
A vulnerability was identified in vllm-project vllm 0.19.0. This issue affects some unknown processing of the component OpenAI-compatible Serving Path. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
A vulnerability was identified in vllm-project vllm 0.19.0. This issue ...
EPSS
5.3 Medium
CVSS3