Skip to content
OpenAdvisories

Package · PyPI

vllm

113 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Low 3.4
    CVE-2026-115917

    vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an…

    vLLM vLLM vllm PyPI
  • Low 3.1
    CVE-2026-105752

    vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation…

    vLLM vLLM vllm PyPI
  • Low 3.1
    CVE-2026-93989

    vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words

    vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, c…

    vLLM vLLM vllm PyPI
  • Low 3.7
    CVE-2026-93841

    vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs

    vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with …

    vLLM vLLM vllm PyPI
  • Low 3.7
    CVE-2026-93840

    vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids

    vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasSta…

    vLLM vLLM vllm PyPI
  • Low 2.6
    CVE-2025-46570

    vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel

    vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT (Time…

    vLLM vLLM vllm PyPI
  • Low 2.6
    CVE-2025-25183

    vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cache

    vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Maliciously constructed statements can lead to hash collisions, resulting in cache reuse, which can interfere with subsequent responses and cause unintended behavior. Prefix…

    vLLM vLLM vllm PyPI