Skip to content
OpenAdvisories
Medium WID-SEC-2026-4151 3 CVEs

vllm: Mehrere Schwachstellen ermöglichen Denial of Service

Published Oct 25, 2026 · Updated Oct 25, 2026 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in vllm ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Open Source vLLM ist eine Open-Source-Bibliothek für schnelle und effiziente Inferenz von Large Language Models (LLMs).

Vulnerabilities 3

  • Medium 6.5
    CVE-2026-116175

    vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions

    vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio via input_audio or …

    vLLM vLLM
  • Medium 6.5
    CVE-2026-116181

    vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids

    vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. Attackers can send OpenAI chat, completion, generate, or batch requests with inv…

    vLLM vLLM
  • Medium 5.9
    CVE-2026-116174

    vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate

    vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_i…

    vLLM vLLM

Revision history

  1. #1

    Initiale Fassung

References