Skip to content
OpenAdvisories

Vendor

vLLM

128 known vulnerabilities.

Products

vLLM 123 vllm-project/vllm 4 AIBrix 1
All Critical High Medium Low Exploited only Public exploit

71 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-115918

    vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs

    vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is c…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-115916

    vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-pa…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-115914

    vLLM DeepSeek-OCR image processing vulnerable to denial of service

    vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalize…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-115913

    vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that ca…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-115911

    vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool

    vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template tha…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-116181

    vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids

    vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. Attackers can send OpenAI chat, completion, generate, or batch requests with inv…

    vLLM vLLM
  • Medium 5.9
    CVE-2026-116178

    vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders

    vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimoda…

    vLLM vLLM vllm PyPI
  • Medium 5.9
    CVE-2026-116174

    vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate

    vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_i…

    vLLM vLLM
  • Medium 6.5
    CVE-2026-116175

    vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions

    vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio via input_audio or …

    vLLM vLLM
  • Medium 5.9
    CVE-2026-116173

    vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids

    vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with output_…

    vLLM vLLM vllm PyPI
  • Medium 5.9
    CVE-2026-116172

    vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n

    vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via CandidateTokens.top_n. Attackers can send Generate or GenerateStream requests with ove…

    vLLM vLLM
  • Medium 6.5
    CVE-2026-114054

    vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys

    vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another requ…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-109311

    vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload

    vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions…

    vLLM vLLM
  • Medium 4.3
    CVE-2026-105922

    vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service

    A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of ser…

    vLLM vLLM vllm PyPI
  • Medium 4.3
    CVE-2026-105775

    vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds

    A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/model_executor/layers/mamba/mamba_mixer2.py of the component Completions Request Handler. The manipulation leads to out-o…

    vLLM vLLM
  • Medium 5.3
    CVE-2026-105760

    vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options without a strict work cei…

    vLLM vLLM vllm PyPI
  • Medium 5.9
    CVE-2026-105759

    vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker …

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-105758

    vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

    vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs.video.fps fields with…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-105757

    vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compil…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-105756

    vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCa…

    vLLM vLLM vllm PyPI
  • Medium 4.2
    CVE-2026-105755

    vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. A concurrent request t…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-105754

    vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-105753

    vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

    vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiv…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-103241

    vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service

    A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be …

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-100654

    vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids

    vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range…

    vLLM vLLM
  • Medium 6.5
    CVE-2026-100653

    vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

    vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat an…

    vLLM vLLM vllm PyPI
  • Medium 5.9
    CVE-2026-100652

    vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids

    vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than z…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-100651

    vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass

    vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' (multimodal) payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal Engine…

    vLLM vLLM
  • Medium 6.5
    CVE-2026-100650

    vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization

    vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits). Ac…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-100648

    vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding

    vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excess…

    vLLM vLLM
  • Medium 5.3
    CVE-2026-100647

    vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

    vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unau…

    vLLM vLLM
  • Medium 5.3
    CVE-2026-94625

    vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

    vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing v…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-69147

    vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

    vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.video.video_backend to pynvvideocodec, and MediaConnector.fetch_video forwards that choice to VideoMe…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-57173

    vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

    vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v1/chat/completions calls AudioMediaIO.load_bytes or AudioMediaIO.load_file without passing VLLM_MAX_AUDIO_DECODE_DURATION_S to the shared a…

    vLLM vLLM vllm PyPI
  • Medium 4.3
    CVE-2026-92365

    vllm-project vllm thinking_budget_state.py algorithmic complexity

    A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the…

    vLLM vLLM
  • Medium 5.3
    CVE-2026-92220

    vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumption

    A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_finished/MoRIIOConnectorWorker.get_finished/MoRIIOWrapper._handle_release_message of the file vllm/distributed/kv_transfer/kv_connector/v1/…

    vLLM vLLM
  • Medium 4.3
    CVE-2026-90878

    vllm-project vLLM Jinja Template Rendering completions resource consumption

    A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chat_template causes resource consumption. The attack …

    vLLM vLLM
  • Medium 6.5
    CVE-2026-90555

    vLLM before 0.28.0 Denial of Service via Audio Header

    vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory all…

    vLLM vLLM
  • Medium 6.2
    CVE-2026-90554

    vLLM before 0.28.0 Denial of Service via audio extraction

    vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In nano_nemotron_vl.py, _extract_audio_from_videos calls load_audio_pyav(BytesIO(video_bytes)) without th…

    vLLM vLLM
  • Medium 5.3
    CVE-2026-78684

    vLLM before 0.27.0 Denial of Service via DeepStream Backend

    vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video t…

    vLLM vLLM vllm PyPI