LLM Testframework

Certifi removes GLOBALTRUST root certificate

HuggingFace transformers vulnerable to remote code execution

Starlette has possible denial-of-service vector when parsing large files in multipart forms

Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

vLLM affected by RCE via auto_map dynamic module loading during model initialization

AIOHTTP has CRLF injection through multipart part content type header construction

urllib3 streaming API improperly handles highly compressed data

PyTorch susceptible to local Denial of Service

Transformers is vulnerable to ReDoS attack through its DonutProcessor class

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Sentencepiece has a a heap overflow issue

vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class

UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

urllib3 does not control redirects in browsers and Node.js

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

LiteLLM: Local file read via request-supplied OIDC file references

vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

LiteLLM: MCP Proxy Has Improper Authentication

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching

vLLM has RCE In Video Processing

Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

LiteLLM: Authentication Bypass via Host Header Injection

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

Vulnerable OpenSSL included in cryptography wheels

LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

AIOHTTP vulnerable to brute-force leak of internal static file path components

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

Denial of service (DoS) via deformation `multipart/form-data` boundary

Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

XGrammar affected by Denial of Service by infinite recursion grammars

LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

AnyIO process-pool workers can block indefinitely on undrained stderr

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Pillow has a heap buffer overflow with nested list coordinates

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)