vllm vulnerabilities
CVEs whose affected-version data names the vllm package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
124 CVEsRSS
CVE-2026-115911Medium· 6.5vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can …
CVE-2026-115912High· 7.5vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployment…
CVE-2026-115913Medium· 6.5vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one legal l…
CVE-2026-115916Medium· 6.5vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass valid…
CVE-2026-115917Low· 3.4vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim…
CVE-2026-115915High· 8.1vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label…
CVE-2026-115914Medium· 6.5vLLM DeepSeek-OCR image processing vulnerable to denial of service
vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal…
CVE-2026-115918Medium· 6.5vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when n…
CVE-2026-116175Medium· 6.5vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions
vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed aud…
CVE-2026-116173Medium· 5.9vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids
vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream…
CVE-2026-116179High· 7.5vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override
vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a larg…
CVE-2026-116178Medium· 5.9vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders
vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can re…
CVE-2026-116180High· 7.7vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors
vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector…
CVE-2026-114050Medium· 6.5vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine
vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine
GHSA-f623-hjm8-5wg5Critical· 8.1Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
GHSA-hfwf-hgvp-4rr8High· 7.5Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization
Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization
GHSA-3cgq-c484-rx5jHigh· 7.5Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
CVE-2026-114049Low· 3.7vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense
vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate…
CVE-2026-114054Medium· 6.5vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys
vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID t…
CVE-2026-114053High· 8.1vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision
vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust…
CVE-2026-114055High· 7.5vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image s…
CVE-2026-109311Medium· 6.5PoCvLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow
vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v…
CVE-2026-105922Medium· 4.3PoC⚖ disputedA security flaw has been discovered in vllm-project vLLM up to 0.31.0
A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation re…
CVE-2026-105775Medium· 4.3PoCA security vulnerability has been detected in vllm-project vLLM up to 0.31.0
A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/model_executor/layers/mamba/mamba_mixer2.py of the component Completions Request Handler. The manip…
CVE-2026-105760Medium· 5.3vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options wit…
CVE-2026-105759Medium· 5.9PoCvLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An una…
CVE-2026-105758Medium· 5.3vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs…
CVE-2026-105757Medium· 6.5vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-…
CVE-2026-105756Medium· 6.5vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServ…
CVE-2026-105755Medium· 4.2vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. …