6.2
Medium
CVE-2024-8939 A vulnerability was found in the ilab model serve component, where improper handling of the best_of parameter in the…
Description
A vulnerability was found in the ilab model serve component, where improper handling of the best_of parameter in the vllm JSON web API can lead to a Denial of Service (DoS). The API used for LLM-based sentence or chat completion accepts a best_of parameter to return the best completion from several options. When this parameter is set to a large value, the API does not handle timeouts or resource exhaustion properly, allowing an attacker to cause a DoS by consuming excessive system resources. This leads to the API becoming unresponsive, preventing legitimate users from accessing the service.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) | Versions not published |
Other CVEs of Red Hat Enterprise Linux AI (RHEL AI)
The 6 CVEs of Red Hat Enterprise Linux AI (RHEL AI) →
CVE-2025-6242
A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's…
7.1
High
CVE-2025-8556
Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results
3.7
Low
CVE-2024-11079
Ansible-core: unsafe tagging bypass via hostvars object in ansible-core
5.5
Medium
CVE-2024-8768
A flaw was found in the vLLM library
7.5
High