Mingkai Yu

LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service

SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room

vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata

vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure

vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions

vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size

vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision

vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids

vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs