CVE-2026-103241

Katalog CVE

CVSS 7.5 · High EPSS 0,71%

Kerentanan Improper Resource Shutdown or Release pada vllm. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 0.29.1rc0 is able to resolve this issue. This patch is called 3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9. Upgrading the affected component is advised.

Rincian

Terbit di NVD

30 September 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-404: Improper Resource Shutdown or Release

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vllm-project/vllm/commit/3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9 patch
• https://github.com/vllm-project/vllm/issues/50927 issue tracking · patch
• https://github.com/vllm-project/vllm/pull/54303 issue tracking · patch
• https://vuldb.com/cve/CVE-2026-103241 advisory pihak ketiga · vdb entry
• https://vuldb.com/submit/956250 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/411965 advisory pihak ketiga · vdb entry
• https://gist.github.com/Yunzez/8e98d656aa667095b513161eb056d28e product
• https://github.com/vllm-project/vllm/ product
• https://github.com/vllm-project/vllm/releases/tag/v0.29.1rc0 release notes
• https://vuldb.com/vuln/411965/cti permissions required · vdb entry