PT-2024-39237 · Unknown · Vllm Library

Max De Bayser · Published 2024-09-17 · Updated 2024-09-21 · CVE-2024-8768

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: vLLM library (affected versions not specified)

Description: A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2024-8768

GHSA-W2R7-9579-27HF

Affected Products

Vllm Library

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-8768 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8768 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w2r7-9579-27hf · Vendor Advisory
• https://github.com/vllm-project/vllm · Note
• https://github.com/vllm-project/vllm/pull/7746 · Note
• https://github.com/vllm-project/vllm/issues/7632 · Note
• https://github.com/vllm-project/vllm/commit/e25fee57c2e69161bd261f5986dc5aeb198bbd42 · Note
• https://twitter.com/cracbot/status/1837733656506650646 · Twitter Post
• https://t.me/latest_high_impact_cve/1164 · Telegram Post
• https://twitter.com/CVEnew/status/1836083745650282496 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2311895 · Note
• https://t.me/cvedetector/5820 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2024-8768 · Note