Skip to content
OpenAdvisories
Medium WID-SEC-2026-3327 8 CVEs

vllm: Mehrere Schwachstellen ermöglichen

Published Sep 13, 2026 · Updated Nov 9, 2026 · Revision 5 · de

Vendor: Red Hat Product: Enterprise Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in vllm ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

Open Source vLLM ist eine Open-Source-Bibliothek für schnelle und effiziente Inferenz von Large Language Models (LLMs).

Vulnerabilities 8

  • Medium 6.5
    CVE-2026-100650

    vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization

    vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits). Ac…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-100651

    vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass

    vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' (multimodal) payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal Engine…

    vLLM vLLM
  • Medium 6.5
    CVE-2026-100653

    vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

    vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat an…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-100654

    vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids

    vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range…

    vLLM vLLM
  • Medium 5.9
    CVE-2026-100652

    vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids

    vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than z…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-100647

    vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

    vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unau…

    vLLM vLLM
  • Medium 5.3
    CVE-2026-100648

    vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding

    vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excess…

    vLLM vLLM
  • Low 3.7
    CVE-2026-100649

    vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

    vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests …

    vLLM vLLM

Revision history

  1. #5

    Neue Updates von Red Hat aufgenommen

  2. #4

    Neue Updates von Red Hat aufgenommen

  3. #3

    Neue Updates von Red Hat aufgenommen

  4. #2

    Referenz(en) aufgenommen: CVE-2026-100648, EUVD-2026-87742, CVE-2026-100647, EUVD-2026-87741, CVE-2026-100652, EUVD-2026-87746, CVE-2026-100651, EUVD-2026-87745, CVE-2026-100649, EUVD-2026-87743, CVE-2026-100653, EUVD-2026-87747, CVE-2026-100650, EUVD-2026-87744, CVE-2026-100654, EUVD-2026-87748

  5. #1

    Initiale Fassung

References