LLM Testframework

Pillow: Infinite loop in MIC n_frames when the embedded TIFF

Certifi removes GLOBALTRUST root certificate

Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

HuggingFace transformers vulnerable to remote code execution

Starlette has possible denial-of-service vector when parsing large files in multipart forms

Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

vLLM affected by RCE via auto_map dynamic module loading during model initialization

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding

AIOHTTP has CRLF injection through multipart part content type header construction

urllib3 streaming API improperly handles highly compressed data

Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

PyTorch susceptible to local Denial of Service

Hugging Face Datasets folder-based builders allow path traversal through file_name metadata

Transformers is vulnerable to ReDoS attack through its DonutProcessor class

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Sentencepiece has a a heap overflow issue

virtualenv: Xonsh activation literals depend on the script decoding codec

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class

UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

Pillow: TarIO negative size field causes infinite CPU-spin loop

vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

virtualenv: Deletion recovery can change a symlink target's mode

Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size

dnspython dns.name.from_wire_parser() excessive CPU use

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

urllib3 does not control redirects in browsers and Node.js

AIOHTTP: Secure attribute not enforced for shared cookie

virtualenv: Downloaded wheel selection and caching precede verification

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

LiteLLM: Local file read via request-supplied OIDC file references

vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

LiteLLM: MCP Proxy Has Improper Authentication

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching

vLLM has RCE In Video Processing