CVE-2024-8768

Published: Sep 17, 2024Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service.

Related CWEs

CWE-617

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (4)

https://access.redhat.com/security/cve/CVE-2024-8768

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2311895

Source: secalert@redhat.com

https://github.com/vllm-project/vllm/issues/7632

Source: secalert@redhat.com

https://github.com/vllm-project/vllm/pull/7746

Source: secalert@redhat.com

Timeline

No history available yet.