Skip to content
OpenAdvisories
Medium WID-SEC-2026-0987 4 CVEs

vllm: Mehrere Schwachstellen

Published Apr 7, 2026 · Updated Aug 19, 2026 · Revision 3 · de-DE

Vendor: Red Hat Product: Enterprise Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in vllm ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.

Product

Open Source vLLM ist eine Open-Source-Bibliothek für schnelle und effiziente Inferenz von Large Language Models (LLMs).

Vulnerabilities 4

  • Medium 6.5
    CVE-2026-34755

    vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing

    vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19.0, the VideoMediaIO.load_base64() method at vllm/multimodal/media/video.py splits video/jpeg data URLs by comma to extract individual JPEG frames, but does not…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-34756

    vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

    vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the n parameter in the Ch…

    vLLM vLLM vllm PyPI
  • Medium 5.9
    CVE-2026-34760

    vLLM: Downmix Implementation Differences as Attack Vectors Against Audio AI Models

    vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa defaults to using numpy.mean for mono downmixing (to_mono), while the international standard ITU-R BS.775-4 specifies a weighted dow…

    vLLM vLLM vllm PyPI
  • Medium 5.4
    CVE-2026-34753 Public exploit

    vLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url `

    vLLM is an inference and serving engine for large language models (LLMs). From 0.16.0 to before 0.19.0, a server-side request forgery (SSRF) vulnerability in download_bytes_from_url allows any actor who can control batch input JSON to make the vLLM batch runn…

    vLLM vLLM vllm PyPI

Revision history

  1. #3

    Neue Updates von Red Hat aufgenommen

  2. #2

    Neue Updates von Red Hat aufgenommen

  3. #1

    Initiale Fassung

References