deepseek-ai/DeepGEMM
1
0
Fork 0
mirror of https://github.com/deepseek-ai/DeepGEMM.git synced 2026-11-05 00:47:26 +00:00
Code Issues 162 Projects Packages Wiki Activity

[GH-ISSUE #481] Please enable private vulnerability reporting / add a security contact #201

New issue
Open
opened 2026-10-26 21:14:39 +00:00 by bsakaguchi · 0 comments
bsakaguchi commented 2026-10-26 21:14:39 +00:00
Owner
Copy link

Originally created by @Sx4DoW on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/deepseek-ai/DeepGEMM/issues/481

Hi maintainers,

I have a memory-safety vulnerability report (an out-of-bounds GPU write, CWE-787)
affecting a public DeepGEMM kernel API, and I would like to disclose it privately.

This repository currently has no SECURITY.md, and GitHub's Private vulnerability
reporting does not appear to be enabled, so there is no confidential channel to reach you.

Could a maintainer please either:

  1. Enable Settings → Security → Private vulnerability reporting (so I can submit the
    full report, PoC, and a suggested patch through GitHub's private advisory flow), or
  2. Share a security contact address I can send the details to?

I am intentionally not including any technical details, affected code locations, or
proof-of-concept in this public issue. I am proposing a standard 90-day coordinated
disclosure and am happy to help with a fix and a CVE.

Thanks,
Ivan Terracciano (GitHub: @Sx4DoW)

Originally created by @Sx4DoW on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/deepseek-ai/DeepGEMM/issues/481 Hi maintainers, I have a memory-safety vulnerability report (an out-of-bounds GPU write, CWE-787) affecting a public DeepGEMM kernel API, and I would like to disclose it privately. This repository currently has no SECURITY.md, and GitHub's Private vulnerability reporting does not appear to be enabled, so there is no confidential channel to reach you. Could a maintainer please either: 1. Enable Settings → Security → Private vulnerability reporting (so I can submit the full report, PoC, and a suggested patch through GitHub's private advisory flow), or 2. Share a security contact address I can send the details to? I am intentionally not including any technical details, affected code locations, or proof-of-concept in this public issue. I am proposing a standard 90-day coordinated disclosure and am happy to help with a fix and a CVE. Thanks, Ivan Terracciano (GitHub: @Sx4DoW)
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
public-sync-20261014
0930-release
nv_dev
fix-mega-moe-fence
public-release-2609
public-release-2607
public-release-2606
mega-update
public-release-260416
ko3n1g/ci/build-wheels
nv_dev_f8e8fb5
nv_dev_950d31a
nv_dev_67fc648
nv_dev_c491439
nv_dev_4ff3f54
v2.1.1.post3
v2.1.1.post2
v2.1.1.post1
v2.1.1
v2.1.0
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

No labels
pull-request
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
deepseek-ai/DeepGEMM#201
No description provided.