Database/AI/ML frameworks & serving
Jupyter Server (Origin validation): `re.match` used for Origin validation
CVSS 7.3CVE-2026-40110AI/ML frameworks & servingcurated
Impact
re.match used for Origin validation → prefix-match bypass
Who can reach it
Malicious page visited by the notebook user
What to do
Upgrade past 2.17.0
References
Related entries
- JupyterHub: A user granted limited access can escalateCVE-2024-41942 · JupyterHubHigh
- Weaviate: Crafted entry name with an absolute pathCVE-2025-67818 · WeaviateHigh
- llama.cpp (`gguf_init_from_file`): Use of uninitialized heap variableCVE-2024-32878 · llama.cpp (`gguf_init_from_file`)High
- vLLM (`MediaConnector` SSRF): SSRF via `load_from_url` in multimodal input handlingCVE-2025-6242 · vLLM (`MediaConnector` SSRF)High
- vLLM (`Nemotron_Nano_VL_Config`): RCE via a config class evaluated at model loadCVE-2025-66448 · vLLM (`Nemotron_Nano_VL_Config`)High
- vLLM: remote media is fully materialized before size and per-prompt limits are enforcedCVE-2026-100650 · vLLM (media acquisition layer, audio_url/base64 chat path, batch speech runner, Rust frontend /tokenize)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.