vllm
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- PyPI
- Vulnerability status
- 174 advisory(ies) without a verdict
Advisories (174)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2823-qmq8-rwvj vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service | < 0.30.0 | Undetermined |
| GHSA-2pc9-4j83-qjmr vLLM affected by RCE via auto_map dynamic module loading during model initialization | 0.10.1 – < 0.14.0 | Undetermined |
| GHSA-2phq-3phc-84px vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank` | < 0.30.0 | Undetermined |
| GHSA-33cg-gxv8-3p8g vLLM denial of service via prompt embeds on M-RoPE models | 0.12.0 – < 0.24.0 | Undetermined |
| GHSA-3f6c-7fw2-ppm4 vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class | 0.5.0 – < 0.11.0 | Undetermined |
| GHSA-3mwp-wvh9-7528 vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server | 0.1.0 – < 0.19.0 | Undetermined |
| GHSA-3ww4-5jv9-j5gm vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors | < 0.22.0 | Undetermined |
| GHSA-48jh-3gj7-fg8v vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m | < 0.26.0 | Undetermined |
| GHSA-4hhp-h66f-j5j7 vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections | < 0.26.0 | Undetermined |
| GHSA-4qjh-9fv9-r85r Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching | < 0.9.0 | Undetermined |
| GHSA-4r2x-xpjr-7cvv vLLM has RCE In Video Processing | 0.8.3 – < 0.14.1 | Undetermined |
| GHSA-58v5-2m8f-94pr vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion | 0.23.0rc2 – < 0.30.0 | Undetermined |
| GHSA-5jv2-g5wq-cmr4 vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving | 0.5.5 – < 0.24.0 | Undetermined |
| GHSA-5vqr-wprc-cpp7 vLLM Deserialization of Untrusted Data vulnerability | ≤ 0.6.2 | Undetermined |
| GHSA-69j4-grxj-j64p vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs` | 0.5.5 – < 0.11.1 | Undetermined |
| GHSA-6c4r-fmh3-7rh8 vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models | 0.5.5 – < 0.18.0 | Undetermined |
| GHSA-6fvq-23cw-5628 vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server | 0.5.1 – < 0.11.0 | Undetermined |
| GHSA-6pr9-rp53-2pmc vLLM: OOM Denial of Service via Audio Decompression Bomb | < 0.24.0 | Undetermined |
| GHSA-6qc9-v4r8-22xg vLLM DOS: Remotely kill vllm over http with invalid JSON schema | 0.8.0 – < 0.9.0 | Undetermined |
| GHSA-7972-pg2x-xr59 vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out | 0.10.1 – < 0.18.0 | Undetermined |
| GHSA-79j6-g2m3-jgfw vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder | 0.10.0 – < 0.10.1.1 | Undetermined |
| GHSA-7h4p-rffg-7823 vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels | 0.8.5 – < 0.24.0 | Undetermined |
| GHSA-7m6h-x95x-82q5 vLLM: Cross-User Data Leak Vulnerability | < 0.27.0 | Undetermined |
| GHSA-83vm-p52w-f9pw vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters | 0.18.0 – < 0.20.0 | Undetermined |
| GHSA-85xf-c7hm-whqw vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites) | < 0.30.0 | Undetermined |
| GHSA-8737-qx52-hjff vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds | < 0.26.0 | Undetermined |
| GHSA-87x5-vmc3-756j vLLM: Completion prompt lists fan out into unbounded engine requests | 0.19.0 – < 0.26.0 | Undetermined |
| GHSA-8fr4-5q9j-m8gm vLLM vulnerable to remote code execution via transformers_utils/get_config | < 0.11.1 | Undetermined |
| GHSA-8jr5-v98p-w75m vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations | 0.11.0 – < 0.24.0 | Undetermined |
| GHSA-8pw2-6jv3-mj5j vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation | < 0.28.0 | Undetermined |
| GHSA-8wr5-jm2h-8r4f vLLM has Remote DoS via Invalid Recovered Token Reinjection | 0.17.1 – < 0.24.0 | Undetermined |
| GHSA-935w-9g4m-p28p vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle | < 0.30.0 | Undetermined |
| GHSA-94f4-hr76-p5j6 vLLM: OpenAI auth bypass | 0.3.0 – < 0.22.0 | Undetermined |
| GHSA-98f3-hwg4-4rf7 vllm has Improper Resource Shutdown or Release | ≤ 0.19.0 | Undetermined |
| GHSA-9f8f-2vmf-885j Data exposure via ZeroMQ on multi-node vLLM deployment | 0.5.2 – < 0.8.5 | Undetermined |
| GHSA-9hcf-v7m4-6m2j vLLM allows clients to crash the openai server with invalid regex | 0.8.0 – < 0.9.0 | Undetermined |
| GHSA-9pcc-gvx5-r5wm Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration | 0.5.2 – < 0.10.0 | Undetermined |
| GHSA-c65p-x677-fgj6 vLLM has a Weakness in MultiModalHasher Image Hashing Implementation | 0.7.0 – < 0.9.0 | Undetermined |
| GHSA-cj47-qj6g-x7r4 vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints | ≤ 0.6.0 | Undetermined |
| GHSA-frvg-qw88-hww9 vllm p2p never connected zmq_exhaustion | < 0.32.0 | Undetermined |
| GHSA-ggpf-24jw-3fcw CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0 | < 0.8.0 | Undetermined |
| GHSA-grg2-63fw-f2qr vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions | 0.6.4 – < 0.12.0 | Undetermined |
| GHSA-gx7p-2j49-hfq4 vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.) | 0.7.3 – < 0.31.0 | Undetermined |
| GHSA-h3rc-6mm3-gc2m vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution | 0.7.3 – < 0.31.0 | Undetermined |
| GHSA-hcwq-8wjf-3gcr vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions | < 0.24.0 | Undetermined |
| GHSA-hf3c-wxg2-49q9 vLLM vulnerable to Denial of Service by abusing xgrammar cache | 0.6.5 – < 0.8.4 | Undetermined |
| GHSA-hgg8-fqqc-vfmw vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router | < 0.24.0 | Undetermined |
| GHSA-hj4w-hm2g-p6w5 vLLM Vulnerable to Remote Code Execution via Mooncake Integration | 0.6.5 – < 0.8.5 | Undetermined |
| GHSA-hjq4-87xh-g4fv vLLM Allows Remote Code Execution via PyNcclPipe Communication Service | 0.6.5 – < 0.8.5 | Undetermined |
| GHSA-hpv8-x276-m59f vLLM Vulnerable to Remote DoS via Special-Token Placeholders | 0.6.1 – < 0.20.0 | Undetermined |
| GHSA-hwrm-c4cx-rf4j vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages | < 0.26.0 | Undetermined |
| GHSA-j828-28rj-hfhp vLLM vulnerable to Regular Expression Denial of Service | 0.6.3 – < 0.9.0 | Undetermined |
| GHSA-mcmc-2m55-j8jj vLLM introduced enhanced protection for CVE-2025-62164 | 0.10.2 – < 0.13.0 | Undetermined |
| GHSA-mgrm-fgjv-mhv8 vLLM denial of service via outlines unbounded cache on disk | < 0.8.0 | Undetermined |
| GHSA-mrw7-hf4f-83pf vLLM deserialization vulnerability leading to DoS and potential RCE | 0.10.2 – < 0.11.1 | Undetermined |
| GHSA-p92p-rxj5-7p2x vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine | < 0.31.0 | Undetermined |
| GHSA-pf3h-qjgv-vcpr vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url ` | 0.16.0 – < 0.19.0 | Undetermined |
| GHSA-pgr7-mhp5-fgjp vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object | ≤ 0.8.1 | Undetermined |
| GHSA-ph3r-5jfg-f84f vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core | < 0.28.0 | Undetermined |
| GHSA-ph72-cqr5-qpp7 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features | < 0.30.0 | Undetermined |
| GHSA-pmqf-x6x8-p7qw vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs | 0.5.5 – < 0.11.1 | Undetermined |
| GHSA-pq5c-rjhq-qp7p vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing | 0.7.0 – < 0.19.0 | Undetermined |
| GHSA-pr7f-p5mw-fc87 vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts | 0.21.0 – < 0.26.0 | Undetermined |
| GHSA-q8gq-377p-jq3r vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution | < 0.22.0 | Undetermined |
| GHSA-qh4c-xf7m-gxfc vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector | < 0.14.1 | Undetermined |
| GHSA-rh4j-5rhw-hr54 vllm: Malicious model to RCE by torch.load in hf_model_weights_iterator | < 0.7.0 | Undetermined |
| GHSA-rm76-4mrf-v9r8 vLLM uses Python 3.12 built-in hash() which leads to predictable hash collisions in prefix cache | < 0.7.2 | Undetermined |
| GHSA-rwxx-mrjm-wc2m vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends | < 0.24.0 | Undetermined |
| GHSA-rxc4-3w6r-4v47 vllm API endpoints vulnerable to Denial of Service Attacks | 0.1.0 – < 0.10.1.1 | Undetermined |
| GHSA-v359-jj2v-j536 vLLM has SSRF Protection Bypass | 0.15.1 – < 0.17.0 | Undetermined |
| GHSA-v82g-2437-67m2 vLLM: Speech-to-text upload size limit is enforced after full UploadFile read | 0.22.0 – < 0.24.0 | Undetermined |
| GHSA-vc6m-hm49-g9qg vLLM: Quadratic Time Complexity in Input Token Processing leads to denial of service | 0.8.0 – < 0.8.5 | Undetermined |
| GHSA-vrq3-r879-7m65 vLLM Tool Schema allows DoS via Malformed pattern and type Fields | 0.8.0 – < 0.9.0 | Undetermined |
| GHSA-w2r7-9579-27hf vLLM denial of service vulnerability | < 0.5.5 | Undetermined |
| GHSA-w6q7-j642-7c25 vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py` | 0.6.4 – < 0.9.0 | Undetermined |
| GHSA-wc36-9694-f9rf vLLM Denial of Service via the best_of parameter | ≤ 0.5.0.post1 | Undetermined |
| GHSA-wcwg-c5fc-9vrc vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method | 0.8.0 – < 0.19.0 | Undetermined |
| GHSA-wr9h-g72x-mwhm vLLM is vulnerable to timing attack at bearer auth | < 0.11.0 | Undetermined |
| GHSA-x368-4g9h-fvv4 vLLM makes Use of Uninitialized Resource | < 0.19.1 | Undetermined |
| GHSA-x3m8-f7g5-qhm7 vLLM Allows Remote Code Execution via Mooncake Integration | 0.6.5 – < 0.8.0 | Undetermined |
| GHSA-x6mc-67gf-chw4 vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach | 0.24.0 – < 0.30.0 | Undetermined |
| PYSEC-2025-222 vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls th | ≤ 0.6.0 | Undetermined |
| PYSEC-2025-223 vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. The outlines library is one of the backends used by vLLM to support struct | < 0.8.0 | Undetermined |
| PYSEC-2025-42 vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration w | < a5450f11c95847cf51a17207af9a3ca5ab569b2c ; 0.6.5 – < 0.8.5 | Undetermined |
| PYSEC-2025-43 vLLM is an inference and serving engine for large language models (LLMs). In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py | < 99404f53c72965b41558aceb1bc2380875f5d848 ; < 0.9.0 | Undetermined |
| PYSEC-2025-50 vLLM, an inference and serving engine for large language models (LLMs), has a Regular Expression Denial of Service (ReDoS) vulnerability in the file `vllm/entry | < 4fc1bf813ad80172c1db31264beaef7d93fe0601 ; 0.6.4 – < 0.9.0 | Undetermined |
| PYSEC-2025-53 vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism | < 77073c77bc2006eb80ea6d5128f076f5e6c6f54f ; < 0.9.0 | Undetermined |
| PYSEC-2025-54 vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a i | < 08bf7840780980c7568c573c70a6a8db94fd45ff ; 0.8.0 – < 0.9.0 | Undetermined |
| PYSEC-2025-55 vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes t | < 08bf7840780980c7568c573c70a6a8db94fd45ff ; 0.8.0 – < 0.9.0 | Undetermined |
| PYSEC-2025-58 vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which is | < d3d6bb13fb62da3234addf6574922a4ec0513d04 ; < 0.7.0 | Undetermined |
| PYSEC-2025-62 vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Maliciously constructed statements can lead to hash collisions, resulting | < 432117cd1f59c76d97da2eaff55a7d758301dbc7 ; < 0.7.2 | Undetermined |
| PYSEC-2025-63 vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed di | < 288ca110f68d23909728627d3100e5a8db820aa2 ; 0.6.5 – < 0.8.0 | Undetermined |
| PYSEC-2026-143 vLLM is an inference and serving engine for large language models (LLMs). In versions from 0.6.4 to before 0.12.0, users can crash the vLLM engine serving multi | 0.6.4 – < 0.12.0 | Undetermined |
| PYSEC-2026-144 vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19.0, the VideoMediaIO.load_base64() method at vllm/multimodal/ | 0.7.0 – < 0.19.0 | Undetermined |
| PYSEC-2026-145 vLLM is an inference and serving engine for large language models (LLMs). From to before 0.20.0, the extract_hidden_states speculative decoding proposer in vLL | 0.18.0 – < 0.20.0 | Undetermined |
| PYSEC-2026-2010 vLLM affected by RCE via auto_map dynamic module loading during model initialization | 0.10.1 – < 0.14.0 | Undetermined |
| PYSEC-2026-2011 vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class | 0.5.0 – < 0.11.0 | Undetermined |
| PYSEC-2026-2012 vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs` | 0.5.5 – < 0.11.1 | Undetermined |
| PYSEC-2026-2013 vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server | 0.5.1 – < 0.11.0 | Undetermined |
| PYSEC-2026-2014 vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder | 0.10.0 – < 0.10.1.1 | Undetermined |
| PYSEC-2026-2015 vLLM vulnerable to remote code execution via transformers_utils/get_config | < 0.11.1 | Undetermined |
| PYSEC-2026-2016 Data exposure via ZeroMQ on multi-node vLLM deployment | 0.5.2 – < 0.8.5 | Undetermined |
| PYSEC-2026-2017 Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration | 0.5.2 – < 0.10.0 | Undetermined |
| PYSEC-2026-2018 vLLM deserialization vulnerability leading to DoS and potential RCE | 0.10.2 – < 0.11.1 | Undetermined |
| PYSEC-2026-2019 vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs | 0.5.5 – < 0.11.1 | Undetermined |
| PYSEC-2026-2020 vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector | < 0.14.1 | Undetermined |
| PYSEC-2026-2021 vllm API endpoints vulnerable to Denial of Service Attacks | 0.1.0 – < 0.10.1.1 | Undetermined |
| PYSEC-2026-2022 phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of service | 0.8.0 – < 0.8.5 | Undetermined |
| PYSEC-2026-2023 vLLM Tool Schema allows DoS via Malformed pattern and type Fields | 0.8.0 – < 0.9.0 | Undetermined |
| PYSEC-2026-2024 vLLM denial of service vulnerability | < 0.5.5 | Undetermined |
| PYSEC-2026-2025 vLLM Denial of Service via the best_of parameter | ≤ 0.5.0.post1 | Undetermined |
| PYSEC-2026-2026 vLLM is vulnerable to timing attack at bearer auth | < 0.11.0 | Undetermined |
| PYSEC-2026-226 vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on | 0.3.0 – < 0.22.0 | Undetermined |
| PYSEC-2026-227 vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack th | < 0.22.1 | Undetermined |
| PYSEC-2026-2297 vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files | 0.10.1 – < 0.18.0 | Undetermined |
| PYSEC-2026-2298 vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM Open | 0.1.0 – < 0.19.0 | Undetermined |
| PYSEC-2026-2299 vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa defaults to using numpy.mean for | 0.5.5 – < 0.18.0 | Undetermined |
| PYSEC-2026-2300 vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading | < 0.22.0 | Undetermined |
| PYSEC-2026-2301 vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM's revision pinning controls do not consistently apply to all art | < 0.22.0 | Undetermined |
| PYSEC-2026-2302 vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMedia | 0.8.0 – < 0.19.0 | Undetermined |
| PYSEC-2026-2303 vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a /v1/completions request with a model us | 0.12.0 – < 0.24.0 | Undetermined |
| PYSEC-2026-2304 vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user- | < 0.24.0 | Undetermined |
| PYSEC-2026-2305 vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/translations routes call re | 0.22.0 – < 0.24.0 | Undetermined |
| PYSEC-2026-2306 A vulnerability was found in vllm up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py of the component | < 0.19.1 | Undetermined |
| PYSEC-2026-250 vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant | 0.10.2 – < 0.13.0 | Undetermined |
| PYSEC-2026-3403 vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving | 0.5.5 – 0.23.0 | Undetermined |
| PYSEC-2026-3404 vLLM: OOM Denial of Service via Audio Decompression Bomb | ≤ 0.23.0 | Undetermined |
| PYSEC-2026-3405 vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels | ≤ 0.23.0 | Undetermined |
| PYSEC-2026-3406 vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations | 0.11.0 – 0.23.0 | Undetermined |
| PYSEC-2026-3407 vllm has Improper Resource Shutdown or Release | ≤ 0.19.0 | Undetermined |
| PYSEC-2026-3408 vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router | ≤ 0.23.0 | Undetermined |
| PYSEC-2026-3409 vLLM Vulnerable to Remote DoS via Special-Token Placeholders | 0.6.1 – < 0.20.0 | Undetermined |
| PYSEC-2026-3410 vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url ` | 0.16.0 – < 0.19.0 | Undetermined |
| PYSEC-2026-3411 vLLM has SSRF Protection Bypass | 0.15.1 – < 0.17.0 | Undetermined |
| PYSEC-2026-3542 vLLM has Remote DoS via Invalid Recovered Token Reinjection | 0.17.1 – < 0.24.0 | Undetermined |
| PYSEC-2026-3704 vLLM: Completion prompt lists fan out into unbounded engine requests | 0.19.0 – < 0.26.0 | Undetermined |
| PYSEC-2026-3933 vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m | < 0.26.0 | Undetermined |
| PYSEC-2026-3934 vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections | < 0.26.0 | Undetermined |
| PYSEC-2026-3935 vLLM: Cross-User Data Leak Vulnerability | < 0.27.0 | Undetermined |
| PYSEC-2026-3936 vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds | < 0.26.0 | Undetermined |
| PYSEC-2026-3937 vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages | < 0.26.0 | Undetermined |
| PYSEC-2026-3938 vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts | 0.21.0 – < 0.26.0 | Undetermined |
| PYSEC-2026-3985 vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when load | < 0.28.0 | Undetermined |
| PYSEC-2026-3996 vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attacker | < 0.30.0 | Undetermined |
| PYSEC-2026-3997 vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to cr | < 0.28.0 | Undetermined |
| PYSEC-2026-3998 vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). At | < 0.29.0 | Undetermined |
| PYSEC-2026-3999 vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset wi | < 0.30.0 | Undetermined |
| PYSEC-2026-4000 vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). At | < 0.30.0 | Undetermined |
| PYSEC-2026-4003 vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can ac | < 0.27.0 | Undetermined |
| PYSEC-2026-4004 vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. A | < 0.30.0 | Undetermined |
| PYSEC-2026-4005 vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block count | < 0.30.0 | Undetermined |
| PYSEC-2026-4006 vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer | < 0.30.0 | Undetermined |
| PYSEC-2026-4007 vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders tha | < 0.30.0 | Undetermined |
| PYSEC-2026-4008 vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbo | < 0.30.0 | Undetermined |
| PYSEC-2026-4178 vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation | < 0.28.0 | Undetermined |
| PYSEC-2026-4179 vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions | < 0.24.0 | Undetermined |
| PYSEC-2026-4184 vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB co | < 0.30.0 | Undetermined |
| PYSEC-2026-4185 vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token | 0.22.0 – < 0.24.0 | Undetermined |
| PYSEC-2026-4186 A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the compon | < 0.27.0 | Undetermined |
| PYSEC-2026-4197 vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the fro | < 0.28.0 | Undetermined |
| PYSEC-2026-4198 vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives e | < 0.30.0 | Undetermined |
| PYSEC-2026-4199 vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and | < 0.30.0 | Undetermined |
| PYSEC-2026-4306 vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service | < 0.30.0 | Undetermined |
| PYSEC-2026-4307 vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion | 0.23.0rc2 – < 0.30.0 | Undetermined |
| PYSEC-2026-4308 vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle | < 0.30.0 | Undetermined |
| PYSEC-2026-4309 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features | < 0.30.0 | Undetermined |
| PYSEC-2026-4310 vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach | 0.24.0 – < 0.30.0 | Undetermined |
| PYSEC-2026-4319 A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/l | < 0.32.0 | Undetermined |
| PYSEC-2026-4324 vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision | 0.22.1 – < 0.28.0 | Undetermined |
| PYSEC-2026-4325 vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP metho | < 0.30.0 | Undetermined |
| PYSEC-2026-565 vLLM has RCE In Video Processing | 0.8.3 – < 0.14.1 | Undetermined |
| PYSEC-2026-566 vLLM Deserialization of Untrusted Data vulnerability | ≤ 0.6.2 | Undetermined |
| PYSEC-2026-567 vLLM Allows Remote Code Execution via PyNcclPipe Communication Service | 0.6.5 – < 0.8.5 | Undetermined |
| PYSEC-2026-568 vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object | ≤ 0.8.1 | Undetermined |
Withdrawn advisories (7)
Withdrawn by their publisher: they affect no version and are not counted above.
- GHSA-3cgq-c484-rx5j Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs · withdrawn
- GHSA-78fp-cf4h-g36p Duplicate Advisory: vLLM introduced enhanced protection for CVE-2025-62164 · withdrawn
- GHSA-8qpc-6rxx-4pxf Duplicate Advisory: vllm p2p never connected zmq_exhaustion · withdrawn
- GHSA-f623-hjm8-5wg5 Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution · withdrawn
- GHSA-hfwf-hgvp-4rr8 Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization · withdrawn
- GHSA-vfm7-4h43-gp6m Duplicate Advisory: vLLM Vulnerable to Regular Expression Denial of Service · withdrawn
- GHSA-x8xr-mj9x-6h7w Duplicate Advisory: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations · withdrawn
Sources
| Source | Licence |
|---|