vllm has 100 CVEs on record between 2024 and 2026. Disclosure cadence is accelerating: 48 in the last 90 days against 15 in the 90 before. The busiest recent month was September 2026 with 25. The median CVSS is 6.5 (medium), with 10 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-770 (21) and CWE-400 (14).

CVEs per month

Last 12 months, by publish date

1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10

Exploited share: 0% vs 1% corpus
Median CVSS: 6.5
Publish → KEV: —
Last 90 days: 48 prev 15

Weakness classes

Products

vllm 100

Follow vllm:RSS feed Save a search →Embed badge ↗

100

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

vllm vulnerabilities

CVEs affecting vllm, newest first. Open any entry for full detail, references, and exploit status.

100 CVEsRSS

CVE-2026-114050Medium· 6.5

5d ago

vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

▾ Sunlitvllm · vllmEPSS 0.20%via OSV

GHSA-f623-hjm8-5wg5Critical· 8.1

1w ago

Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

▾ Midnightvllm · vllmvia GHSA

GHSA-hfwf-hgvp-4rr8High· 7.5

1w ago

Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization

▾ Twilightvllm · vllmvia GHSA

GHSA-3cgq-c484-rx5jHigh· 7.5

1w ago

Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs

▾ Twilightvllm · vllmvia GHSA

CVE-2026-105922Medium· 4.3PoC⚖ disputed

3w ago

A security flaw has been discovered in vllm-project vLLM up to 0.31.0

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation re…

▾ Twilightvllm · vllmEPSS 0.31%via NVD

CVE-2026-105760Medium· 5.3

3w ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options wit…

▾ Sunlitvllm · vllmEPSS 0.30%via NVD

CVE-2026-105759Medium· 5.9PoC

3w ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An una…

▾ Twilightvllm · vllmEPSS 0.41%via NVD

CVE-2026-105758Medium· 5.3

3w ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs…

▾ Sunlitvllm · vllmEPSS 0.30%via NVD

CVE-2026-105757Medium· 6.5

3w ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-…

▾ Sunlitvllm · vllmEPSS 0.31%via NVD

CVE-2026-105756Medium· 6.5

3w ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServ…

▾ Sunlitvllm · vllmEPSS 0.33%via NVD

CVE-2026-105755Medium· 4.2

3w ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. …

▾ Sunlitvllm · vllmEPSS 0.20%via NVD

CVE-2026-105754Medium· 6.5

3w ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifi…

▾ Sunlitvllm · vllmEPSS 0.27%via NVD

CVE-2026-105753Medium· 6.5

3w ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, w…

▾ Sunlitvllm · vllmEPSS 0.43%via NVD

CVE-2026-105752Low· 3.1

3w ago

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cache_salt value, pl…

▾ Sunlitvllm · vllmEPSS 0.22%via NVD

CVE-2026-103241Medium· 5.3PoC⚖ disputed

4w ago

A flaw has been found in vllm-project vLLM up to 0.26.0

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of servi…

CVEs per month

Weakness classes

Products

Worst active — by depth score

vllm vulnerabilities

vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization

Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs

A security flaw has been discovered in vllm-project vLLM up to 0.31.0

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

vLLM is an inference and serving engine for large language models

A flaw has been found in vllm-project vLLM up to 0.26.0

vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore …

vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-p…

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments

vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate

vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor

vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model v…

Duplicate Advisory: vllm p2p never connected zmq_exhaustion

vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed

vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated dep…

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer()