AI Sec Watch

PyJWT has a vulnerability where it accepts OKP private keys (a type of cryptographic key used in EdDSA signatures) that are internally inconsistent: the declared public key component doesn't match the one derived from the private key component. This allows an attacker to create a malicious key where PyJWT performs cryptographic operations with the attacker's private key while the key appears to belong to a legitimate user, potentially allowing stolen access tokens to be misused in DPoP (proof-of-possession) integrations.

An attacker can crash a vLLM server running Qwen2-VL or Qwen3-VL models by sending requests with extremely high values for `max_frames` and `fps` parameters, causing the server to decode massive numbers of video frames and run out of memory. The problem exists because these Qwen video samplers (software components that extract frames from videos) don't enforce limits on these parameters, even though other video backends in the same codebase already implement such safeguards.

vLLM's video chat endpoint accepts user-controlled video sampling options that can cause denial of service (a situation where legitimate requests are slowed or blocked). An attacker can send a tiny video file with extremely high `fps` (frames per second) and `max_frames` values, forcing the server to create and process a huge temporary list during sampling, which wastes CPU and memory even though the actual video has only a few frames.

vLLM versions 0.25.1 and earlier have a security flaw in their scale-out multimodal transport system. When splitting a request into a render step and a separate generate step, the system trusts caller-supplied encoded features without validating them against the active model, allowing authenticated attackers to forge fields that cause crashes, poison shared encoder caches, or lose data integrity.

vLLM versions 0.25.1 and earlier have a vulnerability where three different structured-output request paths (structured output is a feature that constrains an AI's responses to match a specific format) can trigger uncaught exceptions that crash the entire shared engine instead of failing just that one request, causing a denial of service (making the service unavailable) for all users on that engine. The root cause is missing error handling around grammar and token validation for structured output, allowing request-level errors to escape and kill the engine's core processing loop.

vLLM versions 0.25.1 and earlier have a security vulnerability in flash late-interaction scoring (a feature enabled by default), where query embeddings are cached using a request ID that comes directly from a caller-controlled HTTP header (`X-Request-Id`). An attacker can reuse another user's request ID to replace their cached query with their own, causing that user's documents to be scored against the wrong query, or trigger cache errors that crash requests.

```json { "summary": "vLLM (an AI serving framework) accepts a `cache_salt` parameter from users but validates it too loosely—only checking that it's a non-empty string. When LMCache-MP (a caching connector) is enabled, this value gets passed to a stricter validator that rejects strings containing special characters like `/`, `@`, `\`, or null bytes, or longer than 128 characters. If an invalid string is sent, the resulting error crashes the entire engine process instead of just failing that o

vLLM, a system for running large language models, has a vulnerability in versions before 0.30.0 where an attacker can send fake HTTP method tokens (the commands in web requests) to unprotected routes, causing the system to create unlimited memory-consuming tracking records in Prometheus (a monitoring tool that tracks system performance). This eventually crashes the service by using up all available memory.

vLLM (a system for running large language models) has a bug in versions before 0.28.0 where its multimodal cache (a storage system that keeps frequently used media files) can store media in one part of the system but not another, causing crashes when that media is reused later. When a second request tries to use the same cached media, the system fails with an error message and becomes unavailable.