版本配套说明
产品版本信息
| 项目 | 内容 |
|---|---|
| 产品名称 | MindIE Motor CPP |
| 产品版本 | 3.1.0 |
| 版本类型 | 正式版本 |
| 维护周期 | 三个月 |
相关产品版本配套说明
| 产品名称 | 版本 |
|---|---|
| MindCluster | 26.0.0 |
| MindIE LLM | 3.1.0 |
| CCAE | CCAE iMaster CCAE V100R026C00SPC010 |
版本兼容性说明
MindIE各组件需要配套使用，请勿跨版本混用各组件。
表 1 软件版本兼容性说明
| MindIE Motor CPP 版本 | MindCluster 26.0.0 | MindCluster 7.3.0 |
|---|---|---|
| 3.1.0 | Y | Y |
| 3.0.0 | Y | Y |
| 2.3.0 | Y |
| MindIE Motor CPP 版本 | CCAE iMaster CCAE V100R026C00SPC010 | CCAE iMaster CCAE V100R025C30SPC100 |
|---|---|---|
| 3.1.0 | Y | Y |
| 3.0.0 | Y | Y |
| 2.3.0 | Y |
版本使用注意事项
无
3.1.0更新说明
因技术架构升级需要，原 MindIE Motor 代码仓（涵盖 3.0.0 及之前版本）正式更名为 MindIE Motor CPP，后续版本发布将统一使用此命名。该组件仅对接 MindIE LLM 推理引擎。
新增特性
- 支持KV Cache区域HBM ECC故障快速恢复。
- 支持OOM故障推理业务快恢。
- 支持Atlas 800I A3 超节点服务器RoCE网络闪断类故障自愈快恢。
修改特性
本版本继承本产品3.0.0版本的所有特性。
删除特性
无
接口变更说明
无
已解决的问题
无
遗留问题
无
升级影响
升级过程对现行系统的影响
-
对业务的影响 软件版本升级过程中会导致业务中断。
-
对网络通信的影响 对网络通信无影响。
升级后对现行系统的影响
-
对业务的影响 对业务运行无影响。
-
对网络通信的影响 对网络通信无影响。
漏洞修补列表
| 软件名称 | 软件版本 | CVE编号 | 实际CVSS得分 | 漏洞描述 | 解决版本 |
|---|---|---|---|---|---|
| setuptools | 57.5.0 | CVE-2022-40897 | 0 | A regular expression denial of service vulnerability exists in setuptools before 65.5.1 in package_index.py. An attacker can cause excessive CPU consumption through crafted input to the affected regex, resulting in denial of service. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2023-6730 | 0 | Unsafe deserialization in Hugging Face transformers prior to 4.36 allows remote code execution when loading untrusted model data, classified as CWE-502. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2023-7018 | 0 | Unsafe deserialization in Hugging Face transformers prior to 4.36 allows remote attackers to execute arbitrary code when loading untrusted model data with user interaction required. | MindIE 3.1.0 |
| pyarrow | 12.0.1 | CVE-2023-47248 | 0 | Deserialization of untrusted data in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution when reading untrusted Arrow IPC, Feather, or Parquet files. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2024-3568 | 0 | Unsafe deserialization in Hugging Face transformers prior to 4.38 in TFPreTrainedModel.load_repo_checkpoint() allows code execution when loading untrusted TensorFlow checkpoints. | MindIE 3.1.0 |
| cpython | 3.9-3.11 | CVE-2024-6232 | 0 | A regular expression denial of service vulnerability exists in CPython tarfile module before patched releases. Parsing malicious tar archive headers can cause excessive CPU consumption and denial of service. | MindIE 3.1.0 |
| setuptools | 57.5.0 | CVE-2024-6345 | 0 | A code injection vulnerability exists in setuptools prior to 70.0 in the PackageIndex download function. An attacker can execute arbitrary code when the affected component processes attacker-controlled package URLs. | MindIE 3.1.0 |
| cpython | 3.9-3.11 | CVE-2024-6923 | 0 | An email header injection vulnerability exists in CPython email module before patched releases. Improper quoting of newlines during email header serialization can allow injection of arbitrary email headers. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2024-11392 | 0 | Unsafe deserialization in Hugging Face Transformers during MobileViTV2 configuration parsing allows arbitrary code execution when processing malicious model configuration data. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2024-11393 | 0 | Unsafe deserialization in Hugging Face Transformers during MaskFormer model parsing allows arbitrary code execution when processing malicious model files. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2024-11394 | 0 | Unsafe deserialization in Hugging Face Transformers during Trax model loading allows arbitrary code execution when processing malicious model files. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2024-12720 | 0 | A regular expression denial of service vulnerability exists in Hugging Face transformers prior to 4.48.0 in the Nougat fast tokenizer post_process_single() function, allowing denial of service via crafted input. | MindIE 3.1.0 |
| jinja2 | 3.1.3,3.1.4 | CVE-2024-56201 | 0 | Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja_x27;s sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-1194 | 0 | A regular expression denial of service vulnerability exists in Hugging Face transformers prior to 4.50.0 in the GPT-NeoX-Japanese SubWordJapaneseTokenizer, allowing denial of service via crafted input. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-2099 | 0 | A regular expression denial of service vulnerability exists in Hugging Face transformers prior to 4.50.0 in transformers.testing_utils.preprocess_string(), allowing denial of service when processing malicious docstrings. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-3262 | 0 | A regular expression denial of service vulnerability exists in Hugging Face transformers prior to 4.51.0 in transformers commands/chat.py SETTING_RE, allowing denial of service via crafted configuration input. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-3263 | 0 | A regular expression denial of service vulnerability exists in Hugging Face transformers prior to 4.51.0 in configuration_utils.get_configuration_file(), allowing denial of service when selecting or parsing malicious configuration filenames. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-3264 | 0 | A regular expression denial of service vulnerability exists in Hugging Face transformers prior to 4.51.0 in dynamic_module_utils.get_imports(), allowing denial of service when processing malicious dynamic module source code. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-3777 | 0 | An input validation vulnerability exists in Hugging Face transformers prior to 4.52.1 in image_utils URL loading, potentially allowing improper handling of attacker-controlled media URLs. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-3933 | 0 | A regular expression denial of service vulnerability exists in Hugging Face transformers prior to 4.52.1 in DonutProcessor.token2json(), allowing denial of service via crafted token input. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-5197 | 0 | A regular expression denial of service vulnerability exists in Hugging Face transformers prior to 4.53.0 in convert_tf_weight_name_to_pt_weight_name(), allowing denial of service when converting malicious TensorFlow weight names. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-6051 | 0 | A regular expression denial of service vulnerability exists in Hugging Face transformers prior to 4.53.0 in EnglishNormalizer.normalize_numbers(), allowing denial of service via crafted numeric input. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-6638 | 0 | A regular expression denial of service vulnerability exists in Hugging Face transformers prior to 4.53.0 in MarianTokenizer.remove_language_code(), allowing denial of service via crafted language code input. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-6921 | 0 | A regular expression denial of service vulnerability exists in Hugging Face transformers prior to 4.53.0 in the AdamWeightDecay optimizer when processing attacker-controlled include/exclude weight decay patterns. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-14920 | 0 | A vulnerability, which was classified as critical, has been found in Hugging Face transformers (affected version not known).Using CWE to declare the problem leads to CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.Impacted is confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product. | MindIE 3.1.0 |
| Transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-14921 | 0 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-14924 | 0 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-14926 | 0 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a malicious checkpoint.The specific flaw exists within the convert_config function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-14927 | 0 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a malicious checkpoint.The specific flaw exists within the convert_config function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-14928 | 0 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a malicious checkpoint.The specific flaw exists within the convert_config function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-14929 | 0 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2025-14930 | 0 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of weights. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. | MindIE 3.1.0 |
| setuptools | 57.5.0 | CVE-2025-47273 | 0 | A path traversal vulnerability exists in setuptools prior to 78.1.1 in PackageIndex.download, allowing arbitrary file write when downloading packages from attacker-controlled sources. | MindIE 3.1.0 |
| urllib3 | 2.2.3 | CVE-2025-50181 | 0 | A redirect security control bypass exists in urllib3 prior to 2.5.0 when PoolManager is constructed with retries disabled. Redirects may not be properly blocked as intended. | MindIE 3.1.0 |
| urllib3 | 2.2.3 | CVE-2025-50182 | 0 | A redirect security control bypass exists in urllib3 versions 2.2.0 to before 2.5.0 in Pyodide browser/Node.js Fetch/XHR environments when redirects are disabled. | MindIE 3.1.0 |
| urllib3 | 2.2.3 | CVE-2025-66418 | 0 | A resource exhaustion vulnerability exists in urllib3 versions 1.24 to before 2.6.0 in the decompression chain handling. Processing responses with malicious multi-layer Content-Encoding can cause denial of service. | MindIE 3.1.0 |
| urllib3 | 2.2.3 | CVE-2025-66471 | 0 | A resource exhaustion vulnerability exists in urllib3 versions 1.0 to before 2.6.0 in the Streaming API when processing highly compressed data streams. | MindIE 3.1.0 |
| transformers | 4.30.2,4.33.0,4.33.1,4.34.1,4.35.0,4.36.0,4.36.2,4.37.0,4.37.1,4.37.2,4.38.2,4.39.0,4.40.0,4.42.0,4.42.4,4.43.1,4.43.2,4.44.0,4.46.2,4.49.0,4.51.0 | CVE-2026-1839 | 0 | Unsafe deserialization in Hugging Face transformers Trainer._load_rng_state() prior to v5.0.0rc3 allows arbitrary code execution when restoring attacker-controlled checkpoint RNG state files. | MindIE 3.1.0 |
| urllib3 | 2.2.3 | CVE-2026-21441 | 0 | A resource exhaustion vulnerability exists in urllib3 versions 1.22 to before 2.6.3 when streaming requests with preload_content=False follow redirects, allowing denial of service via malicious compressed redirect responses. | MindIE 3.1.0 |
| urllib3 | 2.2.3 | CVE-2026-44431 | 0 | A redirect security control bypass exists in urllib3 versions 1.23 to before 2.7.0 in ProxyManager low-level urlopen with assert_same_host=False, potentially exposing sensitive headers during cross-origin redirects. | MindIE 3.1.0 |
注：实际CVSS得分为0，即产品无实际漏洞攻击场景，不受漏洞影响（代码未编译、代码无调用、编译选项保护等）。