Skip to content
OpenAdvisories

Package · PyPI

vllm

113 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

60 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-115918

    vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs

    vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is c…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-115916

    vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-pa…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-115914

    vLLM DeepSeek-OCR image processing vulnerable to denial of service

    vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalize…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-115913

    vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that ca…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-115911

    vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool

    vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template tha…

    vLLM vLLM vllm PyPI
  • Medium 5.9
    CVE-2026-116178

    vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders

    vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimoda…

    vLLM vLLM vllm PyPI
  • Medium 5.9
    CVE-2026-116173

    vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids

    vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with output_…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-114054

    vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys

    vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another requ…

    vLLM vLLM vllm PyPI
  • Medium 4.3
    CVE-2026-105922

    vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service

    A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of ser…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-105760

    vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options without a strict work cei…

    vLLM vLLM vllm PyPI
  • Medium 5.9
    CVE-2026-105759

    vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker …

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-105758

    vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

    vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs.video.fps fields with…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-105757

    vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compil…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-105756

    vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCa…

    vLLM vLLM vllm PyPI
  • Medium 4.2
    CVE-2026-105755

    vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. A concurrent request t…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-105754

    vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-105753

    vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

    vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiv…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-103241

    vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service

    A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be …

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-100653

    vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

    vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat an…

    vLLM vLLM vllm PyPI
  • Medium 5.9
    CVE-2026-100652

    vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids

    vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than z…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-100650

    vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization

    vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits). Ac…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-94625

    vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

    vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing v…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-69147

    vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

    vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.video.video_backend to pynvvideocodec, and MediaConnector.fetch_video forwards that choice to VideoMe…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-57173

    vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

    vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v1/chat/completions calls AudioMediaIO.load_bytes or AudioMediaIO.load_file without passing VLLM_MAX_AUDIO_DECODE_DURATION_S to the shared a…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-78684

    vLLM before 0.27.0 Denial of Service via DeepStream Backend

    vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video t…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-73560

    vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

    vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, …

    vLLM vLLM vllm PyPI
  • Medium 4.3
    CVE-2026-71486

    vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

    vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generate_responses, choices, token_ids, prompt_l…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-73559

    vLLM: Completion prompt lists fan out into unbounded engine requests

    vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded list[str] or list[list[int]], prompt_to_seq(…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-73558

    vLLM: Cross-User Data Leak Vulnerability

    vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a request processed in the sa…

    vLLM vLLM vllm PyPI
  • Medium 6.3
    CVE-2026-73557

    vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

    vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse.check_sparse_tensor_invariants, whose process-global save, enable, and restore state can…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-73556

    vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574

    vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compile_regex_with_timeout …

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-73555

    vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

    vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_message in vllm/entrypo…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-55646

    vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit

    vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/translations routes call request.file.read() to fully materialize an uploaded audio file into memory before vLLM checks the do…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-47155

    vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors

    vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM's revision pinning controls do not consistently apply to all artifacts loaded for a model. A deployment that supplies --revision or --code-revision can still load …

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-54233

    vLLM: OOM Denial of Service via Audio Decompression Bomb

    vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, vLLM's /v1/audio/transcriptions endpoint limits compressed upload size but not decoded PCM output. A 25MB OPUS file expands to ~14.9GB of float32 PCM at decode time.…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-54236 Scanner template

    vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

    vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message helper that strips object-repr memory addresses from error messages before they reach the client, is …

    vLLM vLLM vllm PyPI
  • Medium 6.9
    CVE-2026-54235

    vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

    vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (<, >), which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semant…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-53923

    vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflow

    vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0, integer truncation of tensor dimensions in vLLM's GGUF dequantize kernels (csrc/quantization/gguf/gguf_kernel.cu) causes partial tensor processing. The outpu…

    vLLM vLLM vllm PyPI
  • Medium 4.3
    CVE-2025-71379

    vllm - Regular Expression Denial of Service in Multiple Components

    vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to ca…

    vLLM vLLM vllm PyPI
  • Medium 4.8
    CVE-2026-12491

    Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations

    A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing. When images are c…

    Red Hat vLLM vLLM Red Hat OpenShift AI (RHOAI) Linux PyPI