Skip to content
OpenAdvisories

Vendor

vLLM

134 known vulnerabilities.

Products

vLLM 129 vllm-project/vllm 4 AIBrix 1
All Critical High Medium Low Exploited only Public exploit

134 results · Feed

  • Medium 6.5
    CVE-2026-105754

    vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-105753

    vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

    vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiv…

    vLLM vLLM vllm PyPI
  • Low 3.1
    CVE-2026-105752

    vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-103241

    vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service

    A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be …

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-100654

    vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids

    vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range…

    vLLM vLLM
  • Medium 6.5
    CVE-2026-100653

    vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

    vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat an…

    vLLM vLLM vllm PyPI
  • Medium 5.9
    CVE-2026-100652

    vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids

    vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than z…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-100651

    vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass

    vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' (multimodal) payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal Engine…

    vLLM vLLM
  • Medium 6.5
    CVE-2026-100650

    vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization

    vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits). Ac…

    vLLM vLLM vllm PyPI
  • Low 3.7
    CVE-2026-100649

    vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

    vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests …

    vLLM vLLM
  • Medium 5.3
    CVE-2026-100648

    vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding

    vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excess…

    vLLM vLLM
  • Medium 5.3
    CVE-2026-100647

    vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

    vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unau…

    vLLM vLLM
  • High 7.5
    CVE-2026-94627

    vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision

    vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting compl…

    vLLM vLLM
  • High 7.5
    CVE-2026-94626

    vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size

    vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deploym…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-94625

    vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

    vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing v…

    vLLM vLLM vllm PyPI
  • High 7.5
    CVE-2026-94624

    vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions

    vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can supply arbitrary remote host and port values in kv_transfer_…

    vLLM vLLM vllm PyPI
  • High 7.5
    CVE-2026-94623

    vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure

    vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers ca…

    vLLM vLLM vllm PyPI
  • High 7.5
    CVE-2026-94622

    vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata

    vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kv_transfer_params dictionary entries to trigger an unca…

    vLLM vLLM vllm PyPI
  • Low 3.1
    CVE-2026-93989

    vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words

    vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, c…

    vLLM vLLM vllm PyPI
  • Low 3.7
    CVE-2026-93841

    vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs

    vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with …

    vLLM vLLM vllm PyPI
  • Low 3.7
    CVE-2026-93840

    vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids

    vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasSta…

    vLLM vLLM vllm PyPI
  • High 7.5
    CVE-2026-93592

    vLLM before 0.28.0 Denial of Service via negative token ID

    vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers…

    vLLM vLLM vllm PyPI
  • High 7.5
    CVE-2026-93436

    vLLM through 0.29.0 Memory Exhaustion via Rejected Requests

    vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max_tokens=0 to exhaust decode-worker memory without bound until the wor…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-69147

    vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

    vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.video.video_backend to pynvvideocodec, and MediaConnector.fetch_video forwards that choice to VideoMe…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-57173

    vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

    vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v1/chat/completions calls AudioMediaIO.load_bytes or AudioMediaIO.load_file without passing VLLM_MAX_AUDIO_DECODE_DURATION_S to the shared a…

    vLLM vLLM vllm PyPI
  • Medium 4.3
    CVE-2026-92365

    vllm-project vllm thinking_budget_state.py algorithmic complexity

    A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_state.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the…

    vLLM vLLM
  • Medium 5.3
    CVE-2026-92220

    vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumption

    A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_finished/MoRIIOConnectorWorker.get_finished/MoRIIOWrapper._handle_release_message of the file vllm/distributed/kv_transfer/kv_connector/v1/…

    vLLM vLLM
  • Medium 4.3
    CVE-2026-90878

    vllm-project vLLM Jinja Template Rendering completions resource consumption

    A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chat_template causes resource consumption. The attack …

    vLLM vLLM
  • Low 3.3
    CVE-2026-90713

    vllm-project vLLM tiktoken vocab File mod.rs new denial of service

    A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/src/backend/hf/mod.rs of the component tiktoken vocab File Handler. The manipulation results in denial…

    vLLM vLLM
  • Medium 6.5
    CVE-2026-90555

    vLLM before 0.28.0 Denial of Service via Audio Header

    vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory all…

    vLLM vLLM
  • Medium 6.2
    CVE-2026-90554

    vLLM before 0.28.0 Denial of Service via audio extraction

    vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In nano_nemotron_vl.py, _extract_audio_from_videos calls load_audio_pyav(BytesIO(video_bytes)) without th…

    vLLM vLLM
  • High 7.8
    CVE-2026-90553

    vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor

    vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processi…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-78684

    vLLM before 0.27.0 Denial of Service via DeepStream Backend

    vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video t…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-73560

    vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

    vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, …

    vLLM vLLM vllm PyPI
  • Medium 4.3
    CVE-2026-71486

    vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

    vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generate_responses, choices, token_ids, prompt_l…

    vLLM vLLM vllm PyPI
  • Medium 6.5
    CVE-2026-73559

    vLLM: Completion prompt lists fan out into unbounded engine requests

    vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded list[str] or list[list[int]], prompt_to_seq(…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-73558

    vLLM: Cross-User Data Leak Vulnerability

    vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a request processed in the sa…

    vLLM vLLM vllm PyPI
  • Medium 6.3
    CVE-2026-73557

    vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

    vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse.check_sparse_tensor_invariants, whose process-global save, enable, and restore state can…

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-73556

    vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574

    vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compile_regex_with_timeout …

    vLLM vLLM vllm PyPI
  • Medium 5.3
    CVE-2026-73555

    vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

    vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_message in vllm/entrypo…

    vLLM vLLM vllm PyPI