Withdraw/update GHSA-x368-4g9h-fvv4 (CVE-2026-7141) - #9158
Open
ppham-nv wants to merge 1 commit into
Open
Conversation
The advisory names 1ad67864 as the patch, but that commit is on no branch or tag in vllm-project/vllm and ships in no release. Testing in the linked issue also shows the named patch does not change the reported behavior. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
github-actions
Bot
changed the base branch from
main
to
ppham-nv/advisory-improvement-9158
August 18, 2026 18:39
ppham-nv
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I think this advisory should be withdrawn as written.
The "patched" commit
1ad67864is the first of two commits on vllm-project/vllm#39283, which is still open, and it was superseded by01b9f9eeafter review. It's on no branch or tag. It will resolve if you hit vllm-project/vllm@1ad6786, because GitHub keeps PR commits even if it's in a fork but nothing ships it officially.The named patch might not change the reported behavior see vllm-project/vllm#39146 (comment): applying that exact patch, with instrumentation confirming the zeroing ran, left the reported divergence in place, while
VLLM_BATCH_INVARIANT=1removed it entirely. (To be confirmed )I propose to
updateorwithdrawnbecause the advisory points at a commit that was never released and a fix that doesn't resolve what was reported. Whatever is behind the original report may be something else entirely — if a real issue is confirmed there, it would need its own analysis and an update to this advisory/ or a new advisory.