Brodmart

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.24.0 **Description** The `structured outputs.regex` API parameter allows user-supplied regular expression strings to be passed to grammar compiler backends without a compilation timeout. In the xgrammar backend, the string is processed without guards. In the outlines backend, while structural issues like lookarounds and backreferences are blocked, no complexity analysis is performed. Consequently, patterns with nested quantifiers can cause exponential state-space expansion, enabling a single request with an adversarial regex to hang an inference worker indefinitely and cause a denial of service. **Recommendations** Update to version 0.24.0.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.23.1rc0 **Description** Temperature validation gates use comparison operators that silently evaluate to False when encountering NaN (Not a Number) or positive Infinity due to Python's IEEE 754 float semantics. These values bypass guards and propagate to GPU sampling kernels, resulting in undefined behavior or CUDA errors that can crash the inference worker and degrade service for all concurrent users. The issue occurs because the ` verify args()` function in `sampling params.py` lacks checks such as `math.isnan()` or `math.isinf()` for the `temperature` variable. **Recommendations** Update to version 0.23.1rc0. As a temporary workaround, restrict the use of non-finite float values for the `temperature` variable to prevent inference worker crashes.

**Name of the Vulnerable Software and Affected Versions** Open WebUI versions prior to 0.9.6 **Description** Several direct, index-addressed Ollama proxy routes allow authenticated users to bypass backend isolation. The system accepts a caller-supplied `url idx` path parameter and uses it as a raw index into the `OLLAMA BASE URLS` list without verifying if the user is authorized to access that specific backend. While the system validates if a user can use a requested model, it fails to validate the destination backend. This allows users to force requests to internal, higher-privilege, or admin-disabled backends, consuming restricted compute resources using the server-side API key. Affected API endpoints include: - '/ollama/api/chat/{url idx}' - '/ollama/api/generate/{url idx}' - '/ollama/api/embed/{url idx}' - '/ollama/api/embeddings/{url idx}' - '/ollama/v1/chat/completions/{url idx}' - '/ollama/v1/completions/{url idx}' - '/ollama/v1/messages/{url idx}' - '/ollama/v1/responses/{url idx}' The issue resides in the `get ollama url()` function, which skips the model-to-backend allow-list mapping when `url idx` is provided. **Recommendations** Update to version 0.9.6. As a temporary workaround, restrict access to the affected API endpoints or avoid using the `url idx` parameter in requests until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Docling versions 2.45.0 through 2.90.0 **Description** The METS-GBS backend's XML parsing and input document format detection lack security controls. This allows for XML External Entity (XXE) attacks, which occur when an XML parser improperly handles external entity references, potentially allowing the reading of local files or causing a denial of service. Additionally, the system is susceptible to decompression bombs (zip bombs), where small archives expand to massive sizes, and unbounded archive extraction, both of which can exhaust memory and disk space or cause application crashes. **Recommendations** Update to version 2.91.0. Avoid processing METS-GBS archives from untrusted sources. Pre-validate archives in an isolated environment with resource limits.

**Name of the Vulnerable Software and Affected Versions** Docling versions prior to 2.94.0 **Description** The HTML backend fails to perform sufficient validation during resource handling. This allows local file system access via `file://` URIs when `enable local fetch` is set to `True`, and enables path traversal outside intended directories through absolute paths or `../` sequences. Additionally, the system does not block internal network resources when `enable remote fetch` is `True`, fails to validate HTTP redirects, and lacks resource limits for `data:` URIs and remote image downloads. These issues can lead to Server-Side Request Forgery (SSRF), where an attacker induces the server to make requests to an internal or unintended resource. **Recommendations** Update to version 2.94.0. As a temporary workaround, keep both `enable local fetch` and `enable remote fetch` set to `False` when processing untrusted HTML documents.

**Name of the Vulnerable Software and Affected Versions** Hyperledger Fabric versions 1.0.0 through 2.2.26 **Description** In the deprecated `fabric-sdk-java` client SDK, the `Channel.java` file implements `readObject()` and exposes the `deSerializeChannel()` function, both of which call `ObjectInputStream.readObject()` on untrusted byte arrays without configuring an `ObjectInputFilter`. This creates a Java deserialization issue where an attacker who can supply crafted serialized Channel bytes—such as by compromising a local channel file or injecting data through an application—can achieve remote code execution (RCE) via gadget chain exploitation. This is a client-side issue and does not involve data transmitted from Fabric peers. **Recommendations** Migrate to `org.hyperledger.fabric:fabric-gateway`, which does not use Java serialization. As a temporary workaround for the deprecated SDK, add an `ObjectInputFilter` to whitelist only expected classes within the `deSerializeChannel()` function.