- Latest release
- 0.33.0 (Nov 2, 2026): no advisory with comparable ranges affects it; 2 advisories (CVE-2025-48887, CVE-2025-32444) can't be checked against versions
- Newest unaffected release
- 0.33.0 (Nov 2, 2026), the latest release, not counting 2 advisories without comparable ranges
- Advisories
- 108 · 8 critical, 41 high, 54 medium, 5 low
- Weekly downloads
- 677.2K
- Dependents
- 94
- Releases
- 101 since 0.0.1 (Jun 19, 2023)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-115918Affects 0.16.0 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-115917Affects 0.0.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-115916Affects 0.0.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-115915Affects 0.0.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-115914Affects 0.11.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-115913Affects 0.0.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-115912Affects 0.0.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-115911Affects 0.19.0 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-116178Affects 0.20.0 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-116177Affects 0.10.2 to 0.24.0 (0.25.0 is outside it)
- CVE-2026-116176Affects 0.9.2 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-116173Affects 0.22.0 to 0.23.0 (0.24.0 is outside it)
Show all 108 advisoriesShow fewer advisories
- CVE-2026-114055Affects 0.7.3 to 0.30.0 (0.31.0 is outside it)
- CVE-2026-114054Affects 0.0.1 to 0.30.0 (0.31.0 is outside it)
- CVE-2026-114053Affects 0.7.3 to 0.30.0 (0.31.0 is outside it)
- CVE-2026-114052Affects 0.24.0 to 0.30.0 (0.31.0 is outside it)
- CVE-2026-114050Affects 0.0.1 to 0.30.0 (0.31.0 is outside it)
- CVE-2026-105922Affects 0.0.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-105760Affects 0.23.0 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-105759Affects 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-105758Affects 0.24.0 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-105757Affects 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-105756Affects 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-105755Affects 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-105754Affects 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-105753Affects 0.0.1 to 0.27.1 (0.28.0 is outside it)
- CVE-2026-105752Affects 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-103241Affects 0.0.1 to 0.26.0 (0.27.0 is outside it)
- CVE-2026-100653Affects 0.22.1 to 0.27.1 (0.28.0 is outside it)
- CVE-2026-100652Affects 0.22.0 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-100650Affects 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-94626Affects 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-94625Affects 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-94624Affects 0.0.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-94623Affects 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-94622Affects 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-93989Affects 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-93841Affects 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-93840Affects 0.0.1 to 0.28.0 (0.29.0 is outside it)
- CVE-2026-93592Affects 0.0.1 to 0.27.1 (0.28.0 is outside it)
- CVE-2026-93436Affects 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-69147Affects 0.0.1 to 0.27.1 (0.28.0 is outside it)
- CVE-2026-57173Affects 0.0.1 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-90553Affects 0.0.1 to 0.27.1 (0.28.0 is outside it)
- CVE-2026-78684Affects 0.0.1 to 0.26.0 (0.27.0 is outside it)
- CVE-2026-73560Affects 0.0.1 to 0.25.1 (0.26.0 is outside it)
- CVE-2026-71486Affects 0.0.1 to 0.25.1 (0.26.0 is outside it)
- CVE-2026-73559Affects 0.19.0 to 0.25.1 (0.26.0 is outside it)
- CVE-2026-73558Affects 0.0.1 to 0.26.0 (0.27.0 is outside it)
- CVE-2026-73557Affects 0.21.0 to 0.25.1 (0.26.0 is outside it)
- CVE-2026-73556Affects 0.0.1 to 0.25.1 (0.26.0 is outside it)
- CVE-2026-73555Affects 0.0.1 to 0.25.1 (0.26.0 is outside it)
- CVE-2026-55514Affects 0.12.0 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-55574Affects 0.0.1 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-54234Affects 0.17.1 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-55646Affects 0.22.0 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-47155Affects 0.0.1 to 0.21.0 (0.22.0 is outside it)
- CVE-2026-41523Affects 0.0.1 to 0.21.0 (0.22.0 is outside it)
- CVE-2026-54232Affects 0.0.1 to 0.22.0 (0.22.1 is outside it)
- CVE-2026-54233Affects 0.0.1 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-54236Affects 0.0.1 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-54235Affects 0.0.1 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-48746Affects 0.3.0 to 0.21.0 (0.22.0 is outside it)
- CVE-2026-53923Affects 0.5.5 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-56340Affects 0.10.2 to 0.12.0 (0.13.0 is outside it)
- CVE-2025-71379Affects 0.6.3 to 0.8.5.post1 (0.9.0 is outside it)
- CVE-2026-12491Affects 0.11.0 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-5497Affects 0.8.0 to 0.18.1 (0.19.0 is outside it)
- CVE-2026-9540Affects 0.0.1 to 0.19.0 (0.19.1 is outside it)
- CVE-2026-44223Affects 0.18.0 to 0.19.1 (0.20.0 is outside it)
- CVE-2026-44222Affects 0.6.1 to 0.19.1 (0.20.0 is outside it)
- CVE-2026-7141Affects 0.0.1 to 0.19.0 (0.19.1 is outside it)
- CVE-2026-34756Affects 0.1.0 to 0.18.1 (0.19.0 is outside it)
- CVE-2026-34755Affects 0.7.0 to 0.18.1 (0.19.0 is outside it)
- CVE-2026-34753Affects 0.16.0 to 0.18.1 (0.19.0 is outside it)
- CVE-2026-34760Affects 0.5.5 to 0.17.1 (0.18.0 is outside it)
- CVE-2026-27893Affects 0.10.1 to 0.17.1 (0.18.0 is outside it)
- CVE-2026-25960Affects 0.15.1 to 0.16.0 (0.17.0 is outside it)
- CVE-2026-22778Affects 0.8.3 to 0.14.0 (0.14.1 is outside it)
- CVE-2026-24779Affects 0.0.1 to 0.14.0 (0.14.1 is outside it)
- CVE-2026-22807Affects 0.10.1 to 0.13.0 (0.14.0 is outside it)
- CVE-2026-22773Affects 0.6.4 to 0.11.2 (0.12.0 is outside it)
- CVE-2025-66448Affects 0.0.1 to 0.11.0 (0.11.1 is outside it)
- CVE-2025-62372Affects 0.5.5 to 0.11.0 (0.11.1 is outside it)
- CVE-2025-62426Affects 0.5.5 to 0.11.0 (0.11.1 is outside it)
- CVE-2025-62164Affects 0.10.2 to 0.11.0 (0.11.1 is outside it)
- CVE-2025-6242Affects 0.5.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2025-59425Affects 0.0.1 to 0.10.2 (0.11.0 is outside it)
- CVE-2025-48956Affects 0.1.0 to 0.10.1 (0.10.1.1 is outside it)
- CVE-2025-48944Affects 0.8.0 to 0.8.5.post1 (0.9.0 is outside it)
- CVE-2025-48943Affects 0.8.0 to 0.8.5.post1 (0.9.0 is outside it)
- CVE-2025-48942Affects 0.8.0 to 0.8.5.post1 (0.9.0 is outside it)
- CVE-2025-48887Its ranges can't be placed on these versionsIts ranges can't be placed on these versions
- CVE-2025-46722Affects 0.0.1 to 0.8.5.post1 (0.9.0 is outside it)
- CVE-2025-46570Affects 0.0.1 to 0.8.5.post1 (0.9.0 is outside it)
- CVE-2025-47277Affects 0.6.5 to 0.8.4 (0.8.5 is outside it)
- CVE-2025-30165Affects 0.5.2 to 0.9.2 (0.10.0 is outside it)
- CVE-2025-32444Its ranges can't be placed on these versionsIts ranges can't be placed on these versions
- CVE-2025-46560Affects 0.8.0 to 0.8.4 (0.8.5 is outside it)
- CVE-2025-30202Affects 0.5.2 to 0.8.4 (0.8.5 is outside it)
- CVE-2024-11041Affects 0.0.1 to 0.6.2 (0.6.3 is outside it)
- CVE-2024-9053Affects 0.0.1 to 0.6.0 (0.6.1 is outside it)
- CVE-2025-29783Affects 0.6.5 to 0.7.3 (0.8.0 is outside it)
- CVE-2025-29770Affects 0.0.1 to 0.7.3 (0.8.0 is outside it)
- CVE-2025-25183Affects 0.0.1 to 0.7.1 (0.7.2 is outside it)
- CVE-2025-24357Affects 0.0.1 to 0.6.6.post1 (0.7.0 is outside it)
- CVE-2024-8939Affects 0.0.1 to 0.5.0.post1 (0.5.1 is outside it)
- CVE-2024-8768Affects 0.0.1 to 0.5.4 (0.5.5 is outside it)
Advisories 108
- CVE-2026-115918Medium 6.5
vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
Affected: from 0.16.0, fixed in 0.32.0.
Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-115917Low 3.4
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
Affected: fixed in 0.32.0.
Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-115916Medium 6.5
vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
Affected: fixed in 0.32.0.
Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-115915High 8.1
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
Affected: fixed in 0.32.0; from 0.30.0, fixed in 0.32.0.
Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-115914Medium 6.5
vLLM DeepSeek-OCR image processing vulnerable to denial of service
Affected: from 0.11.1, fixed in 0.32.0.
Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-115913Medium 6.5
vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine
Affected: fixed in 0.32.0.
Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-115912High 7.5
vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
Affected: fixed in 0.32.0.
Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-115911Medium 6.5
vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
Affected: from 0.19.0, fixed in 0.32.0.
Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-116178High 8.2
vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders
Affected: from 0.20.0, fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 33 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-116177High 8.7
vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass
Affected: from 0.10.2, fixed in 0.25.0.
Fixed in 0.25.0 (released Jul 11, 2026, 106 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-116176High 8.8
vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector
Affected: from 0.9.2, fixed in 0.24.0.
Fixed in 0.24.0 (released Jun 30, 2026, 117 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-116173High 8.2
vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids
Affected: from 0.22.0, fixed in 0.24.0.
Fixed in 0.24.0 (released Jun 30, 2026, 117 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-114055High 8.7
vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
Affected: from 0.7.3, fixed in 0.31.0.
Fixed in 0.31.0 (released Oct 5, 2026, 16 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-114054High 7.1
vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys
Affected: fixed in 0.31.0.
Fixed in 0.31.0 (released Oct 5, 2026, 16 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-114053Critical 9.2
vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision
Affected: from 0.7.3, fixed in 0.31.0.
Fixed in 0.31.0 (released Oct 5, 2026, 16 days before disclosure).
The latest release, 0.33.0, is not affected.
Show all 108 advisoriesShow fewer advisories
- CVE-2026-114052High 8.7
vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs
Affected: from 0.24.0, fixed in 0.31.0.
Fixed in 0.31.0 (released Oct 5, 2026, 16 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-114050High 7.1
vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID
Affected: fixed in 0.31.0.
Fixed in 0.31.0 (released Oct 5, 2026, 16 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-105922Medium 5.3
vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service
Affected: fixed in 0.32.0.
Fixed in 0.32.0 (released Oct 18, 2026, 12 days after disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-105760Medium 5.3
vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion
Affected: from 0.23.0rc2, fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-105759Medium 5.9
vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)
Affected: fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-105758Medium 5.3
vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach
Affected: from 0.24.0, fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-105757Medium 6.5
vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)
Affected: fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-105756Medium 6.5
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
Affected: fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-105755Medium 4.2
vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`
Affected: fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-105754Medium 6.5
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
Affected: fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-105753Medium 6.5
vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core
Affected: fixed in 0.28.0.
Fixed in 0.28.0 (released Aug 26, 2026, 40 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-105752Low 3.1
vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle
Affected: fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-103241Medium 6.9
vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service
Affected: fixed in 0.27.0.
Fixed in 0.27.0 (released Aug 10, 2026, 51 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-100653High 8.3
vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation
Affected: from 0.22.1, fixed in 0.28.0.
Fixed in 0.28.0 (released Aug 26, 2026, 31 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-100652High 8.2
vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids
Affected: from 0.22.0, fixed in 0.24.0.
Fixed in 0.24.0 (released Jun 30, 2026, 88 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-100650High 7.1
vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization
Affected: fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 4 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-94626High 8.7
vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size
Affected: fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 1 day after disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-94625Medium 6.9
vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders
Affected: fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 1 day after disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-94624High 8.7
vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions
Affected: fixed in 0.32.0; fixed in 0.30.0.
Fixed in 0.32.0 (released Oct 18, 2026, 27 days after disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-94623High 8.7
vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure
Affected: fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 1 day after disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-94622High 8.7
vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata
Affected: fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 1 day after disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-93989Low 2.3
vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words
Affected: fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 3 days after disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-93841Medium 6.3
vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs
Affected: fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 4 days after disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-93840Medium 6.3
vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids
Affected: fixed in 0.29.0.
Fixed in 0.29.0 (released Sep 9, 2026, 9 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-93592High 8.7
vLLM before 0.28.0 Denial of Service via negative token ID
Affected: fixed in 0.28.0.
Fixed in 0.28.0 (released Aug 26, 2026, 23 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-93436High 8.7
vLLM through 0.29.0 Memory Exhaustion via Rejected Requests
Affected: fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 22, 2026, 5 days after disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-69147Medium 6.5
vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation
Affected: fixed in 0.28.0.
Fixed in 0.28.0 (released Aug 26, 2026, 21 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-57173Medium 6.5
vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions
Affected: fixed in 0.24.0.
Fixed in 0.24.0 (released Jun 30, 2026, 78 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-90553High 8.5
vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor
Affected: fixed in 0.28.0.
Fixed in 0.28.0 (released Aug 26, 2026, 17 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-78684Medium 6.9
vLLM before 0.27.0 Denial of Service via DeepStream Backend
Affected: fixed in 0.27.0.
Fixed in 0.27.0 (released Aug 10, 2026, 15 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-73560Medium 6.5
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections
Affected: fixed in 0.26.0.
Fixed in 0.26.0 (released Jul 25, 2026, 23 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-71486Medium 4.3
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
Affected: fixed in 0.26.0.
Fixed in 0.26.0 (released Jul 25, 2026, 23 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-73559Medium 6.5
vLLM: Completion prompt lists fan out into unbounded engine requests
Affected: from 0.19.0, fixed in 0.26.0.
Fixed in 0.26.0 (released Jul 25, 2026, 19 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-73558Medium 5.3
vLLM: Cross-User Data Leak Vulnerability
Affected: fixed in 0.27.0.
Fixed in 0.27.0 (released Aug 10, 2026, 3 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-73557Medium 6.3
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
Affected: from 0.21.0, fixed in 0.26.0.
Fixed in 0.26.0 (released Jul 25, 2026, 19 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-73556Medium 5.3
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574
Affected: fixed in 0.26.0.
Fixed in 0.26.0 (released Jul 25, 2026, 19 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-73555Medium 5.3
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
Affected: fixed in 0.26.0.
Fixed in 0.26.0 (released Jul 25, 2026, 19 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-55514High 7.1
vLLM denial of service via prompt embeds on M-RoPE models
Affected: from 0.12.0, fixed in 0.24.0.
Fixed in 0.24.0 (released Jun 30, 2026, 6 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-55574High 8.7
vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends
Affected: fixed in 0.24.0.
Fixed in 0.24.0 (released Jun 30, 2026, 6 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-54234High 7.5
vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection
Affected: from 0.17.1, fixed in 0.24.0.
Fixed in 0.24.0 (released Jun 30, 2026, 6 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-55646Medium 6.5
vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit
Affected: from 0.22.0, fixed in 0.24.0.
Fixed in 0.24.0 (released Jun 30, 2026, 6 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-47155Medium 6.5
vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors
Affected: fixed in 0.22.0.
Fixed in 0.22.0 (released May 29, 2026, 24 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-41523High 7.5
vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution
Affected: fixed in 0.22.0.
Fixed in 0.22.0 (released May 29, 2026, 24 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-54232High 8.8
vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile
Affected: fixed in 0.22.1.
Fixed in 0.22.1 (released Jun 5, 2026, 17 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-54233Medium 6.5
vLLM: OOM Denial of Service via Audio Decompression Bomb
Affected: through 0.23.0; fixed in 0.24.0.
Fixed in 0.24.0 (released Jun 30, 2026, 8 days after disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-54236Medium 5.3
vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
Affected: through 0.23.0; fixed in 0.24.0.
Fixed in 0.24.0 (released Jun 30, 2026, 8 days after disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-54235Medium 6.9
vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels
Affected: from 0.8.5, fixed in 0.24.0; through 0.23.0.
Fixed in 0.24.0 (released Jun 30, 2026, 8 days after disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-48746Critical 9.1
vLLM: OpenAI auth bypass
Affected: from 0.3.0, fixed in 0.22.0.
Fixed in 0.22.0 (released May 29, 2026, 24 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-53923Medium 5.3
vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflow
Affected: from 0.5.5, fixed in 0.24.0; from 0.5.5, through 0.23.0.
Fixed in 0.24.0 (released Jun 30, 2026, 8 days after disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-56340High 8.7
vLLM - Denial of Service via Unvalidated Multimodal Embeddings
Affected: from 0.10.2, fixed in 0.13.0.
Fixed in 0.13.0 (released Dec 19, 2025, 183 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-71379Medium 5.3
vllm - Regular Expression Denial of Service in Multiple Components
Affected: from 0.6.3, fixed in 0.9.0.
Fixed in 0.9.0 (released May 28, 2025, 388 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-12491Medium 4.8
Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations
Affected: from 0.11.0, fixed in 0.24.0; from 0.11.0, through 0.23.0.
Fixed in 0.24.0 (released Jun 30, 2026, 13 days after disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-5497High 7.5
Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm
Affected: from 0.8.0, fixed in 0.19.0.
Fixed in 0.19.0 (released Apr 3, 2026, 69 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-9540Medium 6.9
vllm-project vllm OpenAI-compatible Serving Path denial of service
Affected: through 0.19.0.
Fixed in 0.19.1 (released Apr 18, 2026, 38 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.33.0, is not affected.
- CVE-2026-44223Medium 6.5
vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters
Affected: from 0.18.0, fixed in 0.20.0.
Fixed in 0.20.0 (released Apr 27, 2026, 15 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-44222Medium 6.5
vLLM: Remote DoS via Special-Token Placeholders
Affected: from 0.6.1, fixed in 0.20.0.
Fixed in 0.20.0 (released Apr 27, 2026, 15 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-7141Medium 6.3
vLLM KV Block kv_cache_interface.py has_mamba_layers uninitialized resource
Affected: fixed in 0.19.1.
Fixed in 0.19.1 (released Apr 18, 2026, 9 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-34756Medium 6.5
vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server
Affected: from 0.1.0, fixed in 0.19.0.
Fixed in 0.19.0 (released Apr 3, 2026, 3 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-34755Medium 6.5
vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing
Affected: from 0.7.0, fixed in 0.19.0.
Fixed in 0.19.0 (released Apr 3, 2026, 3 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-34753Medium 5.4
vLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url `
Affected: from 0.16.0, fixed in 0.19.0.
Fixed in 0.19.0 (released Apr 3, 2026, 3 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-34760Medium 5.9
vLLM: Downmix Implementation Differences as Attack Vectors Against Audio AI Models
Affected: from 0.5.5, fixed in 0.18.0.
Fixed in 0.18.0 (released Mar 20, 2026, 13 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-27893High 8.8
vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out
Affected: from 0.10.1, fixed in 0.18.0.
Fixed in 0.18.0 (released Mar 20, 2026, 6 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-25960High 7.1
SSRF Protection Bypass in vLLM
Affected: from 0.15.1, fixed in 0.17.0.
Fixed in 0.17.0 (released Mar 7, 2026, 2 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-22778Critical 9.8
vLLM leaks a heap address when PIL throws an error
Affected: from 0.8.3, fixed in 0.14.1.
Fixed in 0.14.1 (released Jan 24, 2026, 9 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-24779High 7.1
vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`
Affected: fixed in 0.14.1.
Fixed in 0.14.1 (released Jan 24, 2026, 3 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-22807High 8.8
vLLM affected by RCE via auto_map dynamic module loading during model initialization
Affected: from 0.10.1, fixed in 0.14.0.
Fixed in 0.14.0 (released Jan 20, 2026, 1 day before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2026-22773Medium 6.5
vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions
Affected: from 0.6.4, fixed in 0.12.0.
Fixed in 0.12.0 (released Dec 3, 2025, 38 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-66448High 7.1
vLLM vulnerable to remote code execution via transformers_utils/get_config
Affected: fixed in 0.11.1.
Fixed in 0.11.1 (released Nov 19, 2025, 12 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-62372High 8.3
vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs
Affected: from 0.5.5, fixed in 0.11.1.
Fixed in 0.11.1 (released Nov 19, 2025, 2 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-62426Medium 6.5
vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`
Affected: from 0.5.5, fixed in 0.11.1.
Fixed in 0.11.1 (released Nov 19, 2025, 2 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-62164High 8.8
VLLM deserialization vulnerability leading to DoS and potential RCE
Affected: from 0.10.2, fixed in 0.11.1.
Fixed in 0.11.1 (released Nov 19, 2025, 2 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-6242High 7.1
Vllm: server side request forgery (ssrf) in mediaconnector
Affected: from 0.5.0, fixed in 0.11.0.
Fixed in 0.11.0 (released Oct 4, 2025, 3 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-59425High 7.5
vLLM vulnerable to timing attack at bearer auth
Affected: fixed in 0.11.0.
Fixed in 0.11.0 (released Oct 4, 2025, 3 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-48956High 7.5
vLLM API endpoints vulnerable to Denial of Service Attacks
Affected: from 0.1.0, fixed in 0.10.1.1.
Fixed in 0.10.1.1 (released Aug 20, 2025, 1 day before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-48944Medium 6.5
vLLM Tool Schema allows DoS via Malformed pattern and type Fields
Affected: from 0.8.0, fixed in 0.9.0.
Fixed in 0.9.0 (released May 28, 2025, 2 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-48943Medium 6.5
vLLM allows clients to crash the openai server with invalid regex
Affected: from 0.8.0, fixed in 0.9.0.
Fixed in 0.9.0 (released May 28, 2025, 2 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-48942Medium 6.5
vLLM DOS: Remotely kill vllm over http with invalid JSON schema
Affected: from 0.8.0, fixed in 0.9.0.
Fixed in 0.9.0 (released May 28, 2025, 2 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-48887Medium 6.5
vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`
Affected: from 0.6.4, fixed in 0.9.0; from 0.6.4, fixed in 0.9.0.
- CVE-2025-46722Medium 4.2
vLLM has a Weakness in MultiModalHasher Image Hashing Implementation
Affected: fixed in 0.9.0; from 0.7.0, fixed in 0.9.0.
Fixed in 0.9.0 (released May 28, 2025, 1 day before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-46570Low 2.6
vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released May 28, 2025, 1 day before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-47277Critical 9.8
vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
Affected: from 0.6.5, fixed in 0.8.5.
Fixed in 0.8.5 (released Apr 28, 2025, 22 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-30165High 8.0
Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration
Affected: from 0.5.2, fixed in 0.10.0.
Fixed in 0.10.0 (released Jul 25, 2025, 80 days after disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-32444Critical 10.0
vLLM Vulnerable to Remote Code Execution via Mooncake Integration
Affected: from 0.6.5, fixed in 0.8.5; from 0.6.5, fixed in 0.8.5.
- CVE-2025-46560Medium 6.5
vLLM phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of service
Affected: from 0.8.0, fixed in 0.8.5.
Fixed in 0.8.5 (released Apr 28, 2025, 2 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-30202High 7.5
Data exposure via ZeroMQ on multi-node vLLM deployment
Affected: from 0.5.2, fixed in 0.8.5.
Fixed in 0.8.5 (released Apr 28, 2025, 2 days before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2024-11041Critical 9.8
Remote Code Execution in vllm-project/vllm
Affected: through 0.6.2.
Fixed in 0.6.3 (released Oct 14, 2024, 157 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.33.0, is not affected.
- CVE-2024-9053Critical 9.8
Remote Code Execution in vllm-project/vllm
Affected: through 0.6.0.
Fixed in 0.6.1 (released Sep 11, 2024, 190 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.33.0, is not affected.
- CVE-2025-29783Critical 9.1
vLLM Allows Remote Code Execution via Mooncake Integration
Affected: from 0.6.5, fixed in 0.8.0.
Fixed in 0.8.0 (released Mar 18, 2025, 1 day before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-29770Medium 6.5
vLLM denial of service via outlines unbounded cache on disk
Affected: fixed in 0.8.0.
Fixed in 0.8.0 (released Mar 18, 2025, 1 day before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-25183Low 2.6
vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cache
Affected: fixed in 0.7.2.
Fixed in 0.7.2 (released Feb 6, 2025, 1 day before disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2025-24357High 7.5
vLLM allows a malicious model RCE by torch.load in hf_model_weights_iterator
Affected: fixed in 0.7.0.
Fixed in 0.7.0 (released Jan 27, 2025, the day of disclosure).
The latest release, 0.33.0, is not affected.
- CVE-2024-8939Medium 6.2
Vllm: denials of service in vllm json web api
Affected: through 0.5.0.post1.
Fixed in 0.5.1 (released Jul 6, 2024, 73 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.33.0, is not affected.
- CVE-2024-8768High 7.5
Vllm: a completions api request with an empty prompt will crash the vllm api server.
Affected: fixed in 0.5.5.
Fixed in 0.5.5 (released Aug 23, 2024, 25 days before disclosure).
The latest release, 0.33.0, is not affected.