Skip to content
OpenAdvisories
Medium WID-SEC-2026-3564 4 CVEs

vllm: Mehrere Schwachstellen

Published Sep 23, 2026 · Updated Oct 5, 2026 · Revision 2 · de-DE

Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in vllm ausnutzen, um Dateien zu manipulieren Informationen offenzulegen oder einen Denial of Service zu verursachen.

Product

Open Source vLLM ist eine Open-Source-Bibliothek für schnelle und effiziente Inferenz von Large Language Models (LLMs).

Vulnerabilities 4

  • Medium 6.5
    CVE-2026-105754

    vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-105757

    vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compil…

    vLLM vLLM vllm PyPI
  • Medium 4.2
    CVE-2026-105755

    vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. A concurrent request t…

    vLLM vLLM vllm PyPI
  • Low 3.1
    CVE-2026-105752

    vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation…

    vLLM vLLM vllm PyPI

Revision history

  1. #2

    CVE's ergänzt

  2. #1

    Initiale Fassung

References