Package
py3.10-vllm-cuda-12.4
Component
vllm
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Previous location
/usr/lib/python3.10/site-packages/vllm-0.18.2.dev4+gb64f9cc71.d20260819.cu124.dist-info/METADATANew location
/usr/lib/python3.10/site-packages/vllm-0.18.2.dev4+g8b29a08ae.d20260918.cu124.dist-info/METADATAImpact
version-only path change detected during APK rebuild
Status
Impact
GHSA-8wr5-jm2h-8r4f (CVE-2026-54234) is a remote DoS via invalid recovered token reinjection (High) vulnerability in vLLM. The vulnerable component is vllm itself (0.18.1), not an updatable dependency: upstream's fix first appears in vllm 0.24.0.
The py3-vllm-cuda-12.4 stream is pinned to vllm 0.18.1 because it is the last release supporting CUDA 12.4; vllm 0.19.0 and later require CUDA 12.8 or newer (cuda::ptx::fence_proxy_async). Upstream ships no 0.18.x maintenance release: the releases/v0.18.1 branch is identical to the v0.18.1 tag. No upstream release this stream can consume carries the fix, and per the CVE remediation patch policy a backport of the upstream commit is an exception requiring prior approval, so it is not being carried here.
This advisory will be updated if an upstream release compatible with CUDA 12.4 ships the fix. Customers who need the fix today should migrate to the vllm-openai-cuda-13.0 image stream, which carries vllm 0.28.0 (the fix landed in 0.24.0).
Status
Previous location
/usr/lib/python3.10/site-packages/vllm-0.18.2.dev4+g23f7b929e.d20260819.cu124.dist-info/METADATANew location
/usr/lib/python3.10/site-packages/vllm-0.18.2.dev4+gb64f9cc71.d20260819.cu124.dist-info/METADATAImpact
version-only path change detected during APK rebuild
Status
Previous location
/usr/lib/python3.10/site-packages/vllm-0.18.2.dev4+gbf89c38e3.d20260703.cu124.dist-info/METADATANew location
/usr/lib/python3.10/site-packages/vllm-0.18.2.dev4+g23f7b929e.d20260819.cu124.dist-info/METADATAImpact
version-only path change detected during APK rebuild
Status
Impact
The fix for this advisory is available upstream in vLLM 0.24.0. This package tracks the CUDA 12.4 version stream, and vLLM 0.19.0 and later require CUDA >= 12.8 (cuda::ptx::fence_proxy_async), so this stream cannot adopt the fixed version. Remediation is pending a CUDA 12.8+ stream carrying the fix.
Status