CVE-2026-47155

Katalog CVE

CVSS 6.5 · Medium EPSS 0,25%

Kerentanan Insufficient Verification of Data Authenticity pada vllm. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM's revision pinning controls do not consistently apply to all artifacts loaded for a model. A deployment that supplies --revision or --code-revision can still load dynamic code, GGUF files, image processors, retrieval side weights, or same-repository subfolder weights/config from an unpinned/default revision. This is a supply-chain integrity issue for pinned vLLM deployments. Operators can believe they are serving a reviewed model revision while vLLM resolves behavior-affecting nested or sibling artifacts outside that reviewed revision. This vulnerability is fixed in 0.22.0.

Rincian

Terbit di NVD

22 Juni 2026

Terakhir diubah

24 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vllm-project/vllm/commit/d26a28ab033697f55a1414b5b0435de7cd6045b6 patch
• https://github.com/vllm-project/vllm/security/advisories/GHSA-3ww4-5jv9-j5gm advisory pihak ketiga
• https://huntr.com/bounties/3f1e24c0-87d2-4f6c-a705-820f380879ac advisory pihak ketiga
• https://github.com/vllm-project/vllm/pull/42616 issue tracking