vllm-project vllm
121 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-115918 | >= 0.16.0, < 0.32.0 | vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-115917 | < 0.32.0 | vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server | LOW 3.4 | 0.2 % | ||
| CVE-2026-115916 | < 0.32.0 | vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-115915 | < 0.32.0 | vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE | HIGH 8.1 | 0.7 % | ||
| CVE-2026-115914 | >= 0.11.1, < 0.32.0 | vLLM DeepSeek-OCR image processing vulnerable to denial of service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-115913 | < 0.32.0 | vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-115912 | < 0.32.0 | vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled | HIGH 7.5 | 0.5 % | ||
| CVE-2026-115911 | >= 0.19.0, < 0.32.0 | vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-116181 | 0.20.1 – < 0.29.0 | vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids | HIGH 7.1 | 0.4 % | ||
| CVE-2026-116180 | 0.8.5 – < 0.31.0 | vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors | HIGH 8.3 | 0.3 % | ||
| CVE-2026-116179 | 0.18.0 – < 0.31.0 | vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override | HIGH 8.7 | 0.3 % | ||
| CVE-2026-116178 | 0.20.0 – < 0.30.0 | vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders | HIGH 8.2 | 0.3 % | ||
| CVE-2026-116177 | 0.10.2 – < 0.25.0 | vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass | HIGH 8.7 | 0.3 % | ||
| CVE-2026-116176 | 0.9.2 – < 0.24.0 | vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector | HIGH 8.8 | 0.3 % | ||
| CVE-2026-116175 | 0.19.0 – < 0.24.0 | vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions | HIGH 7.1 | 0.3 % | ||
| CVE-2026-116174 | 0.22.0 – < 0.24.0 | vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate | HIGH 8.2 | 0.3 % | ||
| CVE-2026-116173 | 0.22.0 – < 0.24.0 | vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids | HIGH 8.2 | 0.3 % | ||
| CVE-2026-116172 | 0.22.0 – < 0.24.0 | vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n | HIGH 8.2 | 0.3 % | ||
| CVE-2026-114055 | 0.7.3 – < 0.31.0 | vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs | HIGH 8.7 | 0.4 % | ||
| CVE-2026-114054 | < 0.31.0 | vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys | HIGH 7.1 | 0.3 % | ||
| CVE-2026-114053 | 0.7.3 – < 0.31.0 | vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision | CRITICAL 9.2 | 0.5 % | ||
| CVE-2026-114052 | 0.25.0 – < 0.31.0 | vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs | HIGH 8.7 | 0.5 % | ||
| CVE-2026-114051 | < 0.31.0 | vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate | HIGH 7.1 | 0.4 % | ||
| CVE-2026-114050 | < 0.31.0 | vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID | HIGH 7.1 | 0.2 % | ||
| CVE-2026-114049 | < 0.31.0 | vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-109311 | < 0.29.0 | vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload | HIGH 7.1 | 0.5 % | ||
| CVE-2026-105922 | 0.1 ; 0.2 ; 0.3 ; … | vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-105775 | 0.1 ; 0.2 ; 0.3 ; … | vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-105760 | >= 0.23.0rc2, < 0.30.0 | vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-105759 | < 0.30.0 | vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (un… | HIGH 7.5 | 0.4 % | ||
| CVE-2026-105758 | >= 0.24.0, < 0.30.0 | vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-105757 | < 0.30.0 | vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (… | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-105756 | < 0.30.0 | vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` de… | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-105755 | < 030.0 | vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and ind… | MEDIUM 4.2 | 0.2 % | ||
| CVE-2026-105754 | < 0.30.0 | vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-105753 | < 0.28.0 | vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver asser… | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-105752 | < 0.30.0 | vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle | LOW 3.1 | 0.2 % | ||
| CVE-2026-103241 | 0.1 ; 0.2 ; 0.3 ; … | vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service | MEDIUM 6.9 | 0.7 % | ||
| CVE-2026-100654 | < 0.29.0 | vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids | HIGH 7.1 | 0.3 % | ||
| CVE-2026-100653 | 0.22.1 – < 0.28.0 | vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation | HIGH 8.3 | 0.3 % | ||
| CVE-2026-100652 | 0.22.0 – < 0.24.0 | vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids | HIGH 8.2 | 0.4 % | ||
| CVE-2026-100651 | < 0.29.0 | vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass | HIGH 7.1 | 0.4 % | ||
| CVE-2026-100650 | < 0.29.0 | vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization | HIGH 7.1 | 0.8 % | ||
| CVE-2026-100649 | < 0.29.0 | vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-100648 | < 0.29.0 | vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-100647 | < 0.29.0 | vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-94627 | ≤ 0.29.0 | vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision | HIGH 8.7 | 0.6 % | ||
| CVE-2026-94626 | ≤ 0.29.0 | vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size | HIGH 8.7 | 0.6 % | ||
| CVE-2026-94625 | ≤ 0.29.0 | vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders | MEDIUM 6.9 | 0.5 % | ||
| CVE-2026-94624 | ≤ 0.29.0 | vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions | HIGH 8.7 | 0.4 % | ||
| CVE-2026-94623 | ≤ 0.29.0 | vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure | HIGH 8.7 | 0.6 % | ||
| CVE-2026-94622 | ≤ 0.29.0 | vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata | HIGH 8.7 | 0.6 % | ||
| CVE-2026-93989 | ≤ 0.29.0 | vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words | LOW 2.3 | 0.2 % | ||
| CVE-2026-93841 | ≤ 0.29.0 | vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-93840 | < 0.29.0 | vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-93592 | < 0.28.0 | vLLM before 0.28.0 Denial of Service via negative token ID | HIGH 8.7 | 0.5 % | ||
| CVE-2026-93436 | ≤ 0.29.0 | vLLM through 0.29.0 Memory Exhaustion via Rejected Requests | HIGH 8.7 | 0.8 % | ||
| CVE-2026-69147 | < 0.28.0 | vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation | MEDIUM 6.5 | 0.6 % | ||
| CVE-2026-57173 | < 0.24.0 | vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions | MEDIUM 6.5 | 0.7 % | ||
| CVE-2026-92365 | 0.1 ; 0.2 ; 0.3 ; … | vllm-project vllm thinking_budget_state.py algorithmic complexity | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-92220 | 0.26.0 ; 0.27.0 | vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumption | MEDIUM 6.9 | 0.7 % | ||
| CVE-2026-90878 | 0.27.0 ; 0.27.1 | vllm-project vLLM Jinja Template Rendering completions resource consumption | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-90713 | 0.1 ; 0.2 ; 0.3 ; … | vllm-project vLLM tiktoken vocab File mod.rs new denial of service | MEDIUM 4.8 | 0.2 % | ||
| CVE-2026-90555 | < 0.28.0 | vLLM before 0.28.0 Denial of Service via Audio Header | HIGH 7.1 | 0.5 % | ||
| CVE-2026-90554 | 0.10.2 – < 0.28.0 | vLLM before 0.28.0 Denial of Service via audio extraction | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-90553 | < 0.28.0 | vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor | HIGH 8.5 | 0.3 % | ||
| CVE-2026-78684 | < 0.27.0 | vLLM before 0.27.0 Denial of Service via DeepStream Backend | MEDIUM 6.9 | 0.6 % | ||
| CVE-2026-73560 | < 0.26.0 | vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-71486 | < 0.26.0 | vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-73559 | >= 0.19.0, < 0.26.0 | vLLM: Completion prompt lists fan out into unbounded engine requests | MEDIUM 6.5 | 0.6 % | ||
| CVE-2026-73558 | < 0.27.0 | vLLM: Cross-User Data Leak Vulnerability | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-73557 | >= 0.20.2rc0, < 0.26.0 | vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-73556 | < 0.26.0 | vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574 | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-73555 | < 0.26.0 | vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-55514 | >= 0.12.0, < 0.24.0 | vLLM denial of service via prompt embeds on M-RoPE models | HIGH 7.1 | 0.7 % | ||
| CVE-2026-55574 | < 0.24.0 | vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends | HIGH 8.7 | 0.6 % | ||
| CVE-2026-54234 | < 0.24.0 | vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection | HIGH 7.5 | 0.6 % | ||
| CVE-2026-55646 | >= 0.22.0, < 0.24.0 | vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-47155 | < 0.22.0 | vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-41523 | < 0.22.0 | vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution | HIGH 7.5 | 0.9 % | ||
| CVE-2026-54232 | < 0.22.1 | vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile | HIGH 8.8 | 0.6 % | ||
| CVE-2026-54233 | < 0.23.1rc0 | vLLM: OOM Denial of Service via Audio Decompression Bomb | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-54236 | < 0.23.1rc0 | vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router | MEDIUM 5.3 | 0.9 % | ||
| CVE-2026-54235 | < 0.23.1rc0 | vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-48746 | >= 0.3.0, < 0.22.0 | vLLM: OpenAI auth bypass | CRITICAL 9.1 | 1.2 % | ||
| CVE-2026-53923 | >= 0.5.5, < 0.23.1rc0 | vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflow | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-12491 | 0.11.0 – < 0.24.0 | Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations | MEDIUM 4.8 | 0.2 % | ||
| CVE-2026-9540 | 0.19.0 | vllm-project vllm OpenAI-compatible Serving Path denial of service | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-44223 | >= 0.18.0, < 0.20.0 | vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-44222 | >= 0.6.1, < 0.20.0 | vLLM: Remote DoS via Special-Token Placeholders | HIGH 7.5 | 0.4 % | ||
| CVE-2026-34756 | >= 0.1.0, < 0.19.0 | vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-34755 | >= 0.7.0, < 0.19.0 | vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-34753 | >= 0.16.0, < 0.19.0 | vLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url ` | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-34760 | >= 0.5.5, < 0.18.0 | vLLM: Downmix Implementation Differences as Attack Vectors Against Audio AI Models | HIGH 7.1 | 0.3 % | ||
| CVE-2026-27893 | >= 0.10.1, < 0.18.0 | vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out | HIGH 8.8 | 1.4 % | ||
| CVE-2026-25960 | >= 0.15.1, < 0.17.0 | SSRF Protection Bypass in vLLM | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-22778 | >= 0.8.3, < 0.14.1 | vLLM leaks a heap address when PIL throws an error | CRITICAL 9.8 | 18 % | ||
| CVE-2026-24779 | < 0.14.1 | vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector` | HIGH 7.1 | 0.6 % | ||
| CVE-2026-22807 | >= 0.10.1, < 0.14.0 | vLLM affected by RCE via auto_map dynamic module loading during model initialization | CRITICAL 9.8 | 1.0 % | ||
| CVE-2026-22773 | >= 0.6.4, < 0.12.0 | vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions | HIGH 7.5 | 0.4 % | ||
| CVE-2025-66448 | < 0.11.1 | vLLM vulnerable to remote code execution via transformers_utils/get_config | HIGH 8.8 | 0.7 % | ||
| CVE-2025-62372 | >= 0.5.5, < 0.11.1 | vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs | HIGH 8.3 | 0.4 % | ||
| CVE-2025-62426 | >= 0.5.5, < 0.11.1 | vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs` | MEDIUM 6.5 | 0.5 % | ||
| CVE-2025-62164 | >= 0.10.2, < 0.11.1 | VLLM deserialization vulnerability leading to DoS and potential RCE | HIGH 8.8 | 1.0 % | ||
| CVE-2025-59425 | < 0.11.0rc2 | vLLM vulnerable to timing attack at bearer auth | HIGH 7.5 | 0.6 % | ||
| CVE-2025-48956 | >= 0.1.0, < 0.10.1.1 | vLLM API endpoints vulnerable to Denial of Service Attacks | HIGH 7.5 | 0.6 % | ||
| CVE-2025-48944 | >= 0.8.0, < 0.9.0 | vLLM Tool Schema allows DoS via Malformed pattern and type Fields | MEDIUM 6.5 | 0.6 % | ||
| CVE-2025-48943 | >= 0.8.0, < 0.9.0 | vLLM allows clients to crash the openai server with invalid regex | MEDIUM 6.5 | 0.5 % | ||
| CVE-2025-48942 | >= 0.8.0, < 0.9.0 | vLLM DOS: Remotely kill vllm over http with invalid JSON schema | MEDIUM 6.5 | 0.6 % | ||
| CVE-2025-48887 | >= 0.6.4, < 0.9.0 | vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py` | MEDIUM 6.5 | 0.5 % | ||
| CVE-2025-46722 | >= 0.7.0, < 0.9.0 | vLLM has a Weakness in MultiModalHasher Image Hashing Implementation | HIGH 7.3 | 0.3 % | ||
| CVE-2025-46570 | < 0.9.0 | vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel | LOW 2.6 | 0.4 % | ||
| CVE-2025-47277 | >= 0.6.5, < 0.8.5 | vLLM Allows Remote Code Execution via PyNcclPipe Communication Service | CRITICAL 9.8 | 1.0 % | ||
| CVE-2025-30165 | >= 0.5.2, <= 0.8.5.post1 | Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration | HIGH 8.0 | 0.6 % | ||
| CVE-2025-32444 | >= 0.6.5, < 0.8.5 | vLLM Vulnerable to Remote Code Execution via Mooncake Integration | CRITICAL 10.0 | 1.8 % | ||
| CVE-2025-46560 | >= 0.8.0, < 0.8.5 | vLLM phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of service | HIGH 7.5 | 0.5 % | ||
| CVE-2025-30202 | >= 0.5.2, < 0.8.5 | Data exposure via ZeroMQ on multi-node vLLM deployment | HIGH 7.5 | 0.6 % | ||
| CVE-2025-29783 | >= 0.6.5, < 0.8.0 | vLLM Allows Remote Code Execution via Mooncake Integration | CRITICAL 9.1 | 0.7 % | ||
| CVE-2025-29770 | < 0.8.0 | vLLM denial of service via outlines unbounded cache on disk | MEDIUM 6.5 | 0.5 % | ||
| CVE-2025-25183 | < 0.7.2 | vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cache | LOW 2.6 | 0.2 % | ||
| CVE-2025-24357 | < 0.7.0 | vLLM allows a malicious model RCE by torch.load in hf_model_weights_iterator | HIGH 8.8 | 0.9 % |