Skip to content
OpenAdvisories
High WID-SEC-2026-4051 8 CVEs

vllm: Mehrere Schwachstellen

Published Oct 19, 2026 · Updated Oct 26, 2026 · Revision 2 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in vllm ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Sicherheitsvorkehrungen zu umgehen.

Product

Open Source vLLM ist eine Open-Source-Bibliothek für schnelle und effiziente Inferenz von Large Language Models (LLMs).

Vulnerabilities 8

  • High 7.5
    CVE-2026-115912

    vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory m…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2025-62426

    vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`

    vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the /v1/chat/completions and /tokenize endpoints allow a chat_template_kwargs request parameter that is used in the code before it is properly valid…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-115911

    vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool

    vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template tha…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-115913

    vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that ca…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-115914

    vLLM DeepSeek-OCR image processing vulnerable to denial of service

    vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalize…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-115916

    vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-pa…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-115918

    vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs

    vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is c…

    vLLM vLLM vllm PyPI
  • Low 3.4
    CVE-2026-115917

    vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an…

    vLLM vLLM vllm PyPI

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-110035, CVE-2026-115912, EUVD-2026-110022, CVE-2026-115913, EUVD-2026-110023, CVE-2026-115917, EUVD-2026-110038, CVE-2026-115916, EUVD-2026-110036, CVE-2026-115911, EUVD-2026-109996, CVE-2026-115914, EUVD-2026-110032, CVE-2026-115918, EUVD-2026-110039

  2. #1

    Initiale Fassung

References