Zyz3366

**Name of the Vulnerable Software and Affected Versions** lo48576 fbxcel versions prior to 0.9.1 **Description** A denial of service issue exists in the Node Header Handler component within the file `src/pull parser/v7400/parser.rs`. A local attacker can manipulate this component to cause the application to become unavailable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pdeljanov Symphonia versions prior to 0.6.1 **Description** A flaw in the Metadata Handler component allows a local attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** connorskees grass versions prior to 0.13.5 **Description** A flaw in the UTF-8 Character Handler component allows local execution of a manipulation that can lead to a denial of service. The issue resides in the `grass compiler::raw to parse error()` function. **Recommendations** Update to version 0.13.5 or later. As a temporary workaround, restrict local access to the `grass compiler::raw to parse error()` function.

**Name of the Vulnerable Software and Affected Versions** connorskees grass versions prior to 0.13.5 **Description** A local manipulation of the `grass compiler::selector::extend/grass compiler::evaluate::visitor` function can lead to a denial of service. This occurs because the `@extend` algorithm is definitionally exponential, meaning the time required to compile the input does not increase linearly. **Recommendations** Update to a version newer than 0.13.4.

**Name of the Vulnerable Software and Affected Versions** SGLang version 0.5.10.post1 **Description** An issue exists within the Inference HTTP Endpoint component in the file python/sglang/srt/lora/lora manager.py. Remote manipulation of the `lora path` argument can trigger a reachable assertion. This attack is characterized by high complexity and is considered difficult to exploit. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** vllm version 0.19.0 **Description** A remote denial of service can be triggered through improper processing within the OpenAI-compatible Serving Path component. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** vllm versions prior to 0.19.0 **Description** A flaw in the KV Block Handler component, specifically within the `has mamba layers()` function of the `vllm/v1/kv cache interface.py` file, allows for an uninitialized resource through manipulation. This issue can be triggered remotely, although the attack complexity is high and exploitability is difficult. **Recommendations** Deploy patch 1ad67864c0c20f167929e64c875f5c28e1aad9fd for versions prior to 0.19.0. As a temporary workaround, restrict access to the `has mamba layers()` function to minimize the risk of exploitation.