CVE-2026-90878
A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the compo
CVSS
4.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Sep 15, 2026 · Last modified: Sep 15, 2026 · CWE-400 · CWE-404
Not enough EPSS history yet.
A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chat_template causes resource consumption. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
- github.comhttps://github.com/vllm-project/vllm/
- github.comhttps://github.com/vllm-project/vllm/issues/52025
- github.comhttps://github.com/vllm-project/vllm/pull/52163
- vuldb.comhttps://vuldb.com/cve/CVE-2026-90878
- vuldb.comhttps://vuldb.com/submit/927901
- vuldb.comhttps://vuldb.com/vuln/403472
- vuldb.comhttps://vuldb.com/vuln/403472/cti
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-908305.3 MED—
———A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a bug report but has not responded yet.12hCVE-2026-908295.3 MED—
———A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component SHT_GROUP Section Handler. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.12hCVE-2026-908285.3 MED—
———A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elf_orphan_compatible of the file ld/ldelf.c of the component ELF Orphan Section Handler. Performing a manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.13hCVE-2026-127596.5 MED—
———IBM Cloud Pak for Business Automation could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption.13hCVE-2026-845537.5 HIG—
———A resource exhaustion issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may be able to cause a denial-of-service.12hCVE-2026-908164.3 MED—
———A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended.14h