From 312459752314daf36e739c95f92113e07030447c Mon Sep 17 00:00:00 2001 From: Peter Pham Date: Tue, 18 Aug 2026 11:34:00 -0700 Subject: [PATCH] Withdraw GHSA-x368-4g9h-fvv4 (CVE-2026-7141) The advisory names 1ad67864 as the patch, but that commit is on no branch or tag in vllm-project/vllm and ships in no release. Testing in the linked issue also shows the named patch does not change the reported behavior. Co-Authored-By: Claude Opus 5 (1M context) --- .../2026/04/GHSA-x368-4g9h-fvv4/GHSA-x368-4g9h-fvv4.json | 1 + 1 file changed, 1 insertion(+) diff --git a/advisories/github-reviewed/2026/04/GHSA-x368-4g9h-fvv4/GHSA-x368-4g9h-fvv4.json b/advisories/github-reviewed/2026/04/GHSA-x368-4g9h-fvv4/GHSA-x368-4g9h-fvv4.json index 52f0e364132d..59ee60d5f667 100644 --- a/advisories/github-reviewed/2026/04/GHSA-x368-4g9h-fvv4/GHSA-x368-4g9h-fvv4.json +++ b/advisories/github-reviewed/2026/04/GHSA-x368-4g9h-fvv4/GHSA-x368-4g9h-fvv4.json @@ -3,6 +3,7 @@ "id": "GHSA-x368-4g9h-fvv4", "modified": "2026-05-06T17:31:34Z", "published": "2026-04-27T18:32:09Z", + "withdrawn": "2026-08-18T00:00:00Z", "aliases": [ "CVE-2026-7141" ],