vllm: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 5

• High 8.7
  CVE-2026-126397

  vLLM from 0.10.1 before 0.31.0 forwards a request-controlled mm_processor_kwargs.max_patches value to the Hugging Face …

  vLLM vLLM
  Nov 13, 2026
• High 8.2
  CVE-2026-126398

  vLLM from 0.28.0 before 0.30.0 contains a reachable assertion vulnerability in GPUModelRunner._init_xdrope_positions th…

  vLLM vLLM
  Nov 13, 2026
• Medium 6.9
  CVE-2026-126394

  vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vulnerability in OpenCVDynamicOpenPanguVideoBackend, which use…

  vLLM vLLM
  Nov 13, 2026
• Medium 6.5
  CVE-2026-126399

  vLLM 0.19.0 before 0.31.0 Resource Exhaustion via Request-Level num_frames

  vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the server frame limit by setting media_io_kwargs.video.num_frames in chat completion requests. Attackers can supply num_frames=-1 or a large v…

  vLLM vLLM
  Nov 13, 2026
• Medium 5.3
  CVE-2026-126395

  vLLM 0.14.0rc1 before 0.31.0 Heap Address Disclosure via sanitize_message()

  vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose lowercase-only regex fails to scrub uppercase PIL image addresses. Unauthenticated attackers can send a crafted PNG to endpoints such as /tokenize, …

  vLLM vLLM
  Nov 13, 2026

Revision history

1. 2026-11-12 #2

   Referenz(en) aufgenommen: CVE-2026-126395, EUVD-2026-125170, CVE-2026-126397, EUVD-2026-125168, CVE-2026-126399, EUVD-2026-125166, CVE-2026-126398, EUVD-2026-125167, CVE-2026-126394, EUVD-2026-125171

2. 2026-10-27 #1

   Initiale Fassung

References

• GitHub Security Advisory GHSA-5q78-j82c-2vr2 vom 2026-10-27
  https://github.com/vllm-project/vllm/security/advisories/GHSA-5q78-j82c-2vr2
• GitHub Security Advisory GHSA-894j-wg8m-63h8 vom 2026-10-27
  https://github.com/vllm-project/vllm/security/advisories/GHSA-894j-wg8m-63h8
• GitHub Security Advisory GHSA-9g3c-x747-c6wr vom 2026-10-27
  https://github.com/vllm-project/vllm/security/advisories/GHSA-9g3c-x747-c6wr
• GitHub Security Advisory GHSA-m9fg-w9qh-67pc vom 2026-10-27
  https://github.com/vllm-project/vllm/security/advisories/GHSA-m9fg-w9qh-67pc
• GitHub Security Advisory GHSA-vxqj-p4gw-9h4c vom 2026-10-27
  https://github.com/vllm-project/vllm/security/advisories/GHSA-vxqj-p4gw-9h4c
• GitHub Security Advisory GHSA-w4cg-mhc7-mgw3 vom 2026-10-27
  https://github.com/vllm-project/vllm/security/advisories/GHSA-w4cg-mhc7-mgw3