# vllm (PyPI) vulnerabilities

108 known vulnerabilities (8 critical, 41 high, 54 medium, 5 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 0.33.0 (Nov 2, 2026): no advisory with comparable ranges affects it; 2 advisories (CVE-2025-48887, CVE-2025-32444) can't be checked against versions
- Newest unaffected release: 0.33.0 (Nov 2, 2026), the latest release, not counting 2 advisories without comparable ranges
- Weekly downloads: 677.2K
- Dependents: 94
- Releases: 101 since 0.0.1 (Jun 19, 2023)
- Registry: https://pypi.org/project/vllm/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-115918: 0.16.0 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-115917: 0.0.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-115916: 0.0.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-115915: 0.0.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-115914: 0.11.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-115913: 0.0.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-115912: 0.0.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-115911: 0.19.0 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-116178: 0.20.0 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-116177: 0.10.2 to 0.24.0 (0.25.0 is outside it)
- CVE-2026-116176: 0.9.2 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-116173: 0.22.0 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-114055: 0.7.3 to 0.30.0 (0.31.0 is outside it)
- CVE-2026-114054: 0.0.1 to 0.30.0 (0.31.0 is outside it)
- CVE-2026-114053: 0.7.3 to 0.30.0 (0.31.0 is outside it)
- CVE-2026-114052: 0.24.0 to 0.30.0 (0.31.0 is outside it)
- CVE-2026-114050: 0.0.1 to 0.30.0 (0.31.0 is outside it)
- CVE-2026-105922: 0.0.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-105760: 0.23.0 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-105759: 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-105758: 0.24.0 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-105757: 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-105756: 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-105755: 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-105754: 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-105753: 0.0.1 to 0.27.1 (0.28.0 is outside it)
- CVE-2026-105752: 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-103241: 0.0.1 to 0.26.0 (0.27.0 is outside it)
- CVE-2026-100653: 0.22.1 to 0.27.1 (0.28.0 is outside it)
- CVE-2026-100652: 0.22.0 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-100650: 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-94626: 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-94625: 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-94624: 0.0.1 to 0.31.0 (0.32.0 is outside it)
- CVE-2026-94623: 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-94622: 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-93989: 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-93841: 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-93840: 0.0.1 to 0.28.0 (0.29.0 is outside it)
- CVE-2026-93592: 0.0.1 to 0.27.1 (0.28.0 is outside it)
- CVE-2026-93436: 0.0.1 to 0.29.0 (0.30.0 is outside it)
- CVE-2026-69147: 0.0.1 to 0.27.1 (0.28.0 is outside it)
- CVE-2026-57173: 0.0.1 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-90553: 0.0.1 to 0.27.1 (0.28.0 is outside it)
- CVE-2026-78684: 0.0.1 to 0.26.0 (0.27.0 is outside it)
- CVE-2026-73560: 0.0.1 to 0.25.1 (0.26.0 is outside it)
- CVE-2026-71486: 0.0.1 to 0.25.1 (0.26.0 is outside it)
- CVE-2026-73559: 0.19.0 to 0.25.1 (0.26.0 is outside it)
- CVE-2026-73558: 0.0.1 to 0.26.0 (0.27.0 is outside it)
- CVE-2026-73557: 0.21.0 to 0.25.1 (0.26.0 is outside it)
- CVE-2026-73556: 0.0.1 to 0.25.1 (0.26.0 is outside it)
- CVE-2026-73555: 0.0.1 to 0.25.1 (0.26.0 is outside it)
- CVE-2026-55514: 0.12.0 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-55574: 0.0.1 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-54234: 0.17.1 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-55646: 0.22.0 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-47155: 0.0.1 to 0.21.0 (0.22.0 is outside it)
- CVE-2026-41523: 0.0.1 to 0.21.0 (0.22.0 is outside it)
- CVE-2026-54232: 0.0.1 to 0.22.0 (0.22.1 is outside it)
- CVE-2026-54233: 0.0.1 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-54236: 0.0.1 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-54235: 0.0.1 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-48746: 0.3.0 to 0.21.0 (0.22.0 is outside it)
- CVE-2026-53923: 0.5.5 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-56340: 0.10.2 to 0.12.0 (0.13.0 is outside it)
- CVE-2025-71379: 0.6.3 to 0.8.5.post1 (0.9.0 is outside it)
- CVE-2026-12491: 0.11.0 to 0.23.0 (0.24.0 is outside it)
- CVE-2026-5497: 0.8.0 to 0.18.1 (0.19.0 is outside it)
- CVE-2026-9540: 0.0.1 to 0.19.0 (0.19.1 is outside it)
- CVE-2026-44223: 0.18.0 to 0.19.1 (0.20.0 is outside it)
- CVE-2026-44222: 0.6.1 to 0.19.1 (0.20.0 is outside it)
- CVE-2026-7141: 0.0.1 to 0.19.0 (0.19.1 is outside it)
- CVE-2026-34756: 0.1.0 to 0.18.1 (0.19.0 is outside it)
- CVE-2026-34755: 0.7.0 to 0.18.1 (0.19.0 is outside it)
- CVE-2026-34753: 0.16.0 to 0.18.1 (0.19.0 is outside it)
- CVE-2026-34760: 0.5.5 to 0.17.1 (0.18.0 is outside it)
- CVE-2026-27893: 0.10.1 to 0.17.1 (0.18.0 is outside it)
- CVE-2026-25960: 0.15.1 to 0.16.0 (0.17.0 is outside it)
- CVE-2026-22778: 0.8.3 to 0.14.0 (0.14.1 is outside it)
- CVE-2026-24779: 0.0.1 to 0.14.0 (0.14.1 is outside it)
- CVE-2026-22807: 0.10.1 to 0.13.0 (0.14.0 is outside it)
- CVE-2026-22773: 0.6.4 to 0.11.2 (0.12.0 is outside it)
- CVE-2025-66448: 0.0.1 to 0.11.0 (0.11.1 is outside it)
- CVE-2025-62372: 0.5.5 to 0.11.0 (0.11.1 is outside it)
- CVE-2025-62426: 0.5.5 to 0.11.0 (0.11.1 is outside it)
- CVE-2025-62164: 0.10.2 to 0.11.0 (0.11.1 is outside it)
- CVE-2025-6242: 0.5.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2025-59425: 0.0.1 to 0.10.2 (0.11.0 is outside it)
- CVE-2025-48956: 0.1.0 to 0.10.1 (0.10.1.1 is outside it)
- CVE-2025-48944: 0.8.0 to 0.8.5.post1 (0.9.0 is outside it)
- CVE-2025-48943: 0.8.0 to 0.8.5.post1 (0.9.0 is outside it)
- CVE-2025-48942: 0.8.0 to 0.8.5.post1 (0.9.0 is outside it)
- CVE-2025-48887: its ranges can't be placed on these versions
- CVE-2025-46722: 0.0.1 to 0.8.5.post1 (0.9.0 is outside it)
- CVE-2025-46570: 0.0.1 to 0.8.5.post1 (0.9.0 is outside it)
- CVE-2025-47277: 0.6.5 to 0.8.4 (0.8.5 is outside it)
- CVE-2025-30165: 0.5.2 to 0.9.2 (0.10.0 is outside it)
- CVE-2025-32444: its ranges can't be placed on these versions
- CVE-2025-46560: 0.8.0 to 0.8.4 (0.8.5 is outside it)
- CVE-2025-30202: 0.5.2 to 0.8.4 (0.8.5 is outside it)
- CVE-2024-11041: 0.0.1 to 0.6.2 (0.6.3 is outside it)
- CVE-2024-9053: 0.0.1 to 0.6.0 (0.6.1 is outside it)
- CVE-2025-29783: 0.6.5 to 0.7.3 (0.8.0 is outside it)
- CVE-2025-29770: 0.0.1 to 0.7.3 (0.8.0 is outside it)
- CVE-2025-25183: 0.0.1 to 0.7.1 (0.7.2 is outside it)
- CVE-2025-24357: 0.0.1 to 0.6.6.post1 (0.7.0 is outside it)
- CVE-2024-8939: 0.0.1 to 0.5.0.post1 (0.5.1 is outside it)
- CVE-2024-8768: 0.0.1 to 0.5.4 (0.5.5 is outside it)

## Advisories (108)

### [CVE-2026-115918](https://cve.now/CVE-2026-115918): vLLM: Responses API bypasses trust\_request\_chat\_template for chat\_template\_kwargs

- Severity: Medium 6.5
- Published: Oct 26, 2026
- Affected: from 0.16.0, fixed in 0.32.0.
- Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-115917](https://cve.now/CVE-2026-115917): vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

- Severity: Low 3.4
- Published: Oct 26, 2026
- Affected: fixed in 0.32.0.
- Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-115916](https://cve.now/CVE-2026-115916): vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

- Severity: Medium 6.5
- Published: Oct 26, 2026
- Affected: fixed in 0.32.0.
- Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-115915](https://cve.now/CVE-2026-115915): vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

- Severity: High 8.1
- Published: Oct 26, 2026
- Affected: fixed in 0.32.0; from 0.30.0, fixed in 0.32.0.
- Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-115914](https://cve.now/CVE-2026-115914): vLLM DeepSeek-OCR image processing vulnerable to denial of service

- Severity: Medium 6.5
- Published: Oct 26, 2026
- Affected: from 0.11.1, fixed in 0.32.0.
- Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-115913](https://cve.now/CVE-2026-115913): vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

- Severity: Medium 6.5
- Published: Oct 26, 2026
- Affected: fixed in 0.32.0.
- Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-115912](https://cve.now/CVE-2026-115912): vLLM: Public multimodal SHM handle forgery reaches worker-side \`pickle.loads()\` with insecure serialization disabled

- Severity: High 7.5
- Published: Oct 26, 2026
- Affected: fixed in 0.32.0.
- Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-115911](https://cve.now/CVE-2026-115911): vLLM: DoS via unbounded chat\_template Jinja2 rendering exhausts the renderer thread pool

- Severity: Medium 6.5
- Published: Oct 26, 2026
- Affected: from 0.19.0, fixed in 0.32.0.
- Fixed in 0.32.0 (released Oct 18, 2026, 8 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-116178](https://cve.now/CVE-2026-116178): vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm\_placeholders

- Severity: High 8.2
- Published: Oct 25, 2026
- Affected: from 0.20.0, fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 33 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-116177](https://cve.now/CVE-2026-116177): vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

- Severity: High 8.7
- Published: Oct 25, 2026
- Affected: from 0.10.2, fixed in 0.25.0.
- Fixed in 0.25.0 (released Jul 11, 2026, 106 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-116176](https://cve.now/CVE-2026-116176): vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

- Severity: High 8.8
- Published: Oct 25, 2026
- Affected: from 0.9.2, fixed in 0.24.0.
- Fixed in 0.24.0 (released Jun 30, 2026, 117 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-116173](https://cve.now/CVE-2026-116173): vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output\_candidates.token\_ids

- Severity: High 8.2
- Published: Oct 25, 2026
- Affected: from 0.22.0, fixed in 0.24.0.
- Fixed in 0.24.0 (released Jun 30, 2026, 117 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-114055](https://cve.now/CVE-2026-114055): vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm\_processor\_kwargs

- Severity: High 8.7
- Published: Oct 21, 2026
- Affected: from 0.7.3, fixed in 0.31.0.
- Fixed in 0.31.0 (released Oct 5, 2026, 16 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-114054](https://cve.now/CVE-2026-114054): vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys

- Severity: High 7.1
- Published: Oct 21, 2026
- Affected: fixed in 0.31.0.
- Fixed in 0.31.0 (released Oct 5, 2026, 16 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-114053](https://cve.now/CVE-2026-114053): vLLM 0.7.3 before 0.31.0 RCE via mm\_processor\_kwargs.code\_revision

- Severity: Critical 9.2
- Published: Oct 21, 2026
- Affected: from 0.7.3, fixed in 0.31.0.
- Fixed in 0.31.0 (released Oct 5, 2026, 16 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-114052](https://cve.now/CVE-2026-114052): vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm\_processor\_kwargs

- Severity: High 8.7
- Published: Oct 21, 2026
- Affected: from 0.24.0, fixed in 0.31.0.
- Fixed in 0.31.0 (released Oct 5, 2026, 16 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-114050](https://cve.now/CVE-2026-114050): vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID

- Severity: High 7.1
- Published: Oct 21, 2026
- Affected: fixed in 0.31.0.
- Fixed in 0.31.0 (released Oct 5, 2026, 16 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-105922](https://cve.now/CVE-2026-105922): vllm-project vLLM Penalty utils.py get\_token\_bin\_counts\_and\_mask denial of service

- Severity: Medium 5.3
- Published: Oct 6, 2026
- Affected: fixed in 0.32.0.
- Fixed in 0.32.0 (released Oct 18, 2026, 12 days after disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-105760](https://cve.now/CVE-2026-105760): vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

- Severity: Medium 5.3
- Published: Oct 5, 2026
- Affected: from 0.23.0rc2, fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-105759](https://cve.now/CVE-2026-105759): vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)

- Severity: Medium 5.9
- Published: Oct 5, 2026
- Affected: fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-105758](https://cve.now/CVE-2026-105758): vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max\_frames, which the num\_frames ceiling does not reach

- Severity: Medium 5.3
- Published: Oct 5, 2026
- Affected: from 0.24.0, fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-105757](https://cve.now/CVE-2026-105757): vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

- Severity: Medium 6.5
- Published: Oct 5, 2026
- Affected: fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-105756](https://cve.now/CVE-2026-105756): vLLM: Loose \`cache\_salt\` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream \`ValueError\` denial of service

- Severity: Medium 6.5
- Published: Oct 5, 2026
- Affected: fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-105755](https://cve.now/CVE-2026-105755): vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on \`/score\` and \`/rerank\`

- Severity: Medium 4.2
- Published: Oct 5, 2026
- Affected: fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-105754](https://cve.now/CVE-2026-105754): vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

- Severity: Medium 6.5
- Published: Oct 5, 2026
- Affected: fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-105753](https://cve.now/CVE-2026-105753): vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

- Severity: Medium 6.5
- Published: Oct 5, 2026
- Affected: fixed in 0.28.0.
- Fixed in 0.28.0 (released Aug 26, 2026, 40 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-105752](https://cve.now/CVE-2026-105752): vLLM: Harmony tool continuations drop \`cache\_salt\` — restoring a cross-tenant prefix-cache membership oracle

- Severity: Low 3.1
- Published: Oct 5, 2026
- Affected: fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 13 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-103241](https://cve.now/CVE-2026-103241): vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service

- Severity: Medium 6.9
- Published: Sep 30, 2026
- Affected: fixed in 0.27.0.
- Fixed in 0.27.0 (released Aug 10, 2026, 51 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-100653](https://cve.now/CVE-2026-100653): vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

- Severity: High 8.3
- Published: Sep 26, 2026
- Affected: from 0.22.1, fixed in 0.28.0.
- Fixed in 0.28.0 (released Aug 26, 2026, 31 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-100652](https://cve.now/CVE-2026-100652): vLLM 0.22.0 through 0.23.0 Denial of Service via stop\_token\_ids

- Severity: High 8.2
- Published: Sep 26, 2026
- Affected: from 0.22.0, fixed in 0.24.0.
- Fixed in 0.24.0 (released Jun 30, 2026, 88 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-100650](https://cve.now/CVE-2026-100650): vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization

- Severity: High 7.1
- Published: Sep 26, 2026
- Affected: fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 4 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-94626](https://cve.now/CVE-2026-94626): vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp\_size

- Severity: High 8.7
- Published: Sep 21, 2026
- Affected: fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 1 day after disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-94625](https://cve.now/CVE-2026-94625): vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

- Severity: Medium 6.9
- Published: Sep 21, 2026
- Affected: fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 1 day after disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-94624](https://cve.now/CVE-2026-94624): vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions

- Severity: High 8.7
- Published: Sep 21, 2026
- Affected: fixed in 0.32.0; fixed in 0.30.0.
- Fixed in 0.32.0 (released Oct 18, 2026, 27 days after disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-94623](https://cve.now/CVE-2026-94623): vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure

- Severity: High 8.7
- Published: Sep 21, 2026
- Affected: fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 1 day after disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-94622](https://cve.now/CVE-2026-94622): vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata

- Severity: High 8.7
- Published: Sep 21, 2026
- Affected: fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 1 day after disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-93989](https://cve.now/CVE-2026-93989): vLLM through 0.29.0 Cross-Request Logits Corruption via bad\_words

- Severity: Low 2.3
- Published: Sep 19, 2026
- Affected: fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 3 days after disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-93841](https://cve.now/CVE-2026-93841): vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs

- Severity: Medium 6.3
- Published: Sep 18, 2026
- Affected: fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 4 days after disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-93840](https://cve.now/CVE-2026-93840): vLLM before 0.29.0 Cross-Request Logits Corruption via allowed\_token\_ids

- Severity: Medium 6.3
- Published: Sep 18, 2026
- Affected: fixed in 0.29.0.
- Fixed in 0.29.0 (released Sep 9, 2026, 9 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-93592](https://cve.now/CVE-2026-93592): vLLM before 0.28.0 Denial of Service via negative token ID

- Severity: High 8.7
- Published: Sep 18, 2026
- Affected: fixed in 0.28.0.
- Fixed in 0.28.0 (released Aug 26, 2026, 23 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-93436](https://cve.now/CVE-2026-93436): vLLM through 0.29.0 Memory Exhaustion via Rejected Requests

- Severity: High 8.7
- Published: Sep 17, 2026
- Affected: fixed in 0.30.0.
- Fixed in 0.30.0 (released Sep 22, 2026, 5 days after disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-69147](https://cve.now/CVE-2026-69147): vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

- Severity: Medium 6.5
- Published: Sep 16, 2026
- Affected: fixed in 0.28.0.
- Fixed in 0.28.0 (released Aug 26, 2026, 21 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-57173](https://cve.now/CVE-2026-57173): vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

- Severity: Medium 6.5
- Published: Sep 16, 2026
- Affected: fixed in 0.24.0.
- Fixed in 0.24.0 (released Jun 30, 2026, 78 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-90553](https://cve.now/CVE-2026-90553): vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor

- Severity: High 8.5
- Published: Sep 12, 2026
- Affected: fixed in 0.28.0.
- Fixed in 0.28.0 (released Aug 26, 2026, 17 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-78684](https://cve.now/CVE-2026-78684): vLLM before 0.27.0 Denial of Service via DeepStream Backend

- Severity: Medium 6.9
- Published: Aug 25, 2026
- Affected: fixed in 0.27.0.
- Fixed in 0.27.0 (released Aug 10, 2026, 15 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-73560](https://cve.now/CVE-2026-73560): vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor \`\_fetch\_image\` and audio loader bypass MediaConnector protections

- Severity: Medium 6.5
- Published: Aug 17, 2026
- Affected: fixed in 0.26.0.
- Fixed in 0.26.0 (released Jul 25, 2026, 23 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-71486](https://cve.now/CVE-2026-71486): vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

- Severity: Medium 4.3
- Published: Aug 17, 2026
- Affected: fixed in 0.26.0.
- Fixed in 0.26.0 (released Jul 25, 2026, 23 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-73559](https://cve.now/CVE-2026-73559): vLLM: Completion prompt lists fan out into unbounded engine requests

- Severity: Medium 6.5
- Published: Aug 13, 2026
- Affected: from 0.19.0, fixed in 0.26.0.
- Fixed in 0.26.0 (released Jul 25, 2026, 19 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-73558](https://cve.now/CVE-2026-73558): vLLM: Cross-User Data Leak Vulnerability

- Severity: Medium 5.3
- Published: Aug 13, 2026
- Affected: fixed in 0.27.0.
- Fixed in 0.27.0 (released Aug 10, 2026, 3 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-73557](https://cve.now/CVE-2026-73557): vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

- Severity: Medium 6.3
- Published: Aug 13, 2026
- Affected: from 0.21.0, fixed in 0.26.0.
- Fixed in 0.26.0 (released Jul 25, 2026, 19 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-73556](https://cve.now/CVE-2026-73556): vLLM: ReDoS via structured\_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574

- Severity: Medium 5.3
- Published: Aug 13, 2026
- Affected: fixed in 0.26.0.
- Fixed in 0.26.0 (released Jul 25, 2026, 19 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-73555](https://cve.now/CVE-2026-73555): vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

- Severity: Medium 5.3
- Published: Aug 13, 2026
- Affected: fixed in 0.26.0.
- Fixed in 0.26.0 (released Jul 25, 2026, 19 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-55514](https://cve.now/CVE-2026-55514): vLLM denial of service via prompt embeds on M-RoPE models

- Severity: High 7.1
- Published: Jul 6, 2026
- Affected: from 0.12.0, fixed in 0.24.0.
- Fixed in 0.24.0 (released Jun 30, 2026, 6 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-55574](https://cve.now/CVE-2026-55574): vLLM: ReDoS via structured\_outputs.regex compiled without timeout in xgrammar and outlines backends

- Severity: High 8.7
- Published: Jul 6, 2026
- Affected: fixed in 0.24.0.
- Fixed in 0.24.0 (released Jun 30, 2026, 6 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-54234](https://cve.now/CVE-2026-54234): vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection

- Severity: High 7.5
- Published: Jul 6, 2026
- Affected: from 0.17.1, fixed in 0.24.0.
- Fixed in 0.24.0 (released Jun 30, 2026, 6 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-55646](https://cve.now/CVE-2026-55646): vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit

- Severity: Medium 6.5
- Published: Jul 6, 2026
- Affected: from 0.22.0, fixed in 0.24.0.
- Fixed in 0.24.0 (released Jun 30, 2026, 6 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-47155](https://cve.now/CVE-2026-47155): vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors

- Severity: Medium 6.5
- Published: Jun 22, 2026
- Affected: fixed in 0.22.0.
- Fixed in 0.22.0 (released May 29, 2026, 24 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-41523](https://cve.now/CVE-2026-41523): vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

- Severity: High 7.5
- Published: Jun 22, 2026
- Affected: fixed in 0.22.0.
- Fixed in 0.22.0 (released May 29, 2026, 24 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-54232](https://cve.now/CVE-2026-54232): vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile

- Severity: High 8.8
- Published: Jun 22, 2026
- Affected: fixed in 0.22.1.
- Fixed in 0.22.1 (released Jun 5, 2026, 17 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-54233](https://cve.now/CVE-2026-54233): vLLM: OOM Denial of Service via Audio Decompression Bomb

- Severity: Medium 6.5
- Published: Jun 22, 2026
- Affected: through 0.23.0; fixed in 0.24.0.
- Fixed in 0.24.0 (released Jun 30, 2026, 8 days after disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-54236](https://cve.now/CVE-2026-54236): vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

- Severity: Medium 5.3
- Published: Jun 22, 2026
- Affected: through 0.23.0; fixed in 0.24.0.
- Fixed in 0.24.0 (released Jun 30, 2026, 8 days after disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-54235](https://cve.now/CVE-2026-54235): vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

- Severity: Medium 6.9
- Published: Jun 22, 2026
- Affected: from 0.8.5, fixed in 0.24.0; through 0.23.0.
- Fixed in 0.24.0 (released Jun 30, 2026, 8 days after disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-48746](https://cve.now/CVE-2026-48746): vLLM: OpenAI auth bypass

- Severity: Critical 9.1
- Published: Jun 22, 2026
- Affected: from 0.3.0, fixed in 0.22.0.
- Fixed in 0.22.0 (released May 29, 2026, 24 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-53923](https://cve.now/CVE-2026-53923): vLLM GGUF Kernels: int64\_t to int truncation of tensor dimensions causes GPU buffer overflow

- Severity: Medium 5.3
- Published: Jun 22, 2026
- Affected: from 0.5.5, fixed in 0.24.0; from 0.5.5, through 0.23.0.
- Fixed in 0.24.0 (released Jun 30, 2026, 8 days after disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-56340](https://cve.now/CVE-2026-56340): vLLM - Denial of Service via Unvalidated Multimodal Embeddings

- Severity: High 8.7
- Published: Jun 20, 2026
- Affected: from 0.10.2, fixed in 0.13.0.
- Fixed in 0.13.0 (released Dec 19, 2025, 183 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-71379](https://cve.now/CVE-2025-71379): vllm - Regular Expression Denial of Service in Multiple Components

- Severity: Medium 5.3
- Published: Jun 20, 2026
- Affected: from 0.6.3, fixed in 0.9.0.
- Fixed in 0.9.0 (released May 28, 2025, 388 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-12491](https://cve.now/CVE-2026-12491): Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations

- Severity: Medium 4.8
- Published: Jun 17, 2026
- Affected: from 0.11.0, fixed in 0.24.0; from 0.11.0, through 0.23.0.
- Fixed in 0.24.0 (released Jun 30, 2026, 13 days after disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-5497](https://cve.now/CVE-2026-5497): Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm

- Severity: High 7.5
- Published: Jun 11, 2026
- Affected: from 0.8.0, fixed in 0.19.0.
- Fixed in 0.19.0 (released Apr 3, 2026, 69 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-9540](https://cve.now/CVE-2026-9540): vllm-project vllm OpenAI-compatible Serving Path denial of service

- Severity: Medium 6.9
- Published: May 26, 2026
- Affected: through 0.19.0.
- Fixed in 0.19.1 (released Apr 18, 2026, 38 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-44223](https://cve.now/CVE-2026-44223): vLLM: extract\_hidden\_states speculative decoding crashes server on any request with penalty parameters

- Severity: Medium 6.5
- Published: May 12, 2026
- Affected: from 0.18.0, fixed in 0.20.0.
- Fixed in 0.20.0 (released Apr 27, 2026, 15 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-44222](https://cve.now/CVE-2026-44222): vLLM: Remote DoS via Special-Token Placeholders

- Severity: Medium 6.5
- Published: May 12, 2026
- Affected: from 0.6.1, fixed in 0.20.0.
- Fixed in 0.20.0 (released Apr 27, 2026, 15 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-7141](https://cve.now/CVE-2026-7141): vLLM KV Block kv\_cache\_interface.py has\_mamba\_layers uninitialized resource

- Severity: Medium 6.3
- Published: Apr 27, 2026
- Affected: fixed in 0.19.1.
- Fixed in 0.19.1 (released Apr 18, 2026, 9 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-34756](https://cve.now/CVE-2026-34756): vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded \`n\` Parameter in OpenAI API Server

- Severity: Medium 6.5
- Published: Apr 6, 2026
- Affected: from 0.1.0, fixed in 0.19.0.
- Fixed in 0.19.0 (released Apr 3, 2026, 3 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-34755](https://cve.now/CVE-2026-34755): vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing

- Severity: Medium 6.5
- Published: Apr 6, 2026
- Affected: from 0.7.0, fixed in 0.19.0.
- Fixed in 0.19.0 (released Apr 3, 2026, 3 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-34753](https://cve.now/CVE-2026-34753): vLLM affected by Server-Side Request Forgery (SSRF) in \`download\_bytes\_from\_url \`

- Severity: Medium 5.4
- Published: Apr 6, 2026
- Affected: from 0.16.0, fixed in 0.19.0.
- Fixed in 0.19.0 (released Apr 3, 2026, 3 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-34760](https://cve.now/CVE-2026-34760): vLLM: Downmix Implementation Differences as Attack Vectors Against Audio AI Models

- Severity: Medium 5.9
- Published: Apr 2, 2026
- Affected: from 0.5.5, fixed in 0.18.0.
- Fixed in 0.18.0 (released Mar 20, 2026, 13 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-27893](https://cve.now/CVE-2026-27893): vLLM's hardcoded trust\_remote\_code=True in NemotronVL and KimiK25 bypasses user security opt-out

- Severity: High 8.8
- Published: Mar 26, 2026
- Affected: from 0.10.1, fixed in 0.18.0.
- Fixed in 0.18.0 (released Mar 20, 2026, 6 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-25960](https://cve.now/CVE-2026-25960): SSRF Protection Bypass in vLLM

- Severity: High 7.1
- Published: Mar 9, 2026
- Affected: from 0.15.1, fixed in 0.17.0.
- Fixed in 0.17.0 (released Mar 7, 2026, 2 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-22778](https://cve.now/CVE-2026-22778): vLLM leaks a heap address when PIL throws an error

- Severity: Critical 9.8
- Published: Feb 2, 2026
- Affected: from 0.8.3, fixed in 0.14.1.
- Fixed in 0.14.1 (released Jan 24, 2026, 9 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-24779](https://cve.now/CVE-2026-24779): vLLM vulnerable to Server-Side Request Forgery (SSRF) in \`MediaConnector\`

- Severity: High 7.1
- Published: Jan 27, 2026
- Affected: fixed in 0.14.1.
- Fixed in 0.14.1 (released Jan 24, 2026, 3 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-22807](https://cve.now/CVE-2026-22807): vLLM affected by RCE via auto\_map dynamic module loading during model initialization

- Severity: High 8.8
- Published: Jan 21, 2026
- Affected: from 0.10.1, fixed in 0.14.0.
- Fixed in 0.14.0 (released Jan 20, 2026, 1 day before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2026-22773](https://cve.now/CVE-2026-22773): vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions

- Severity: Medium 6.5
- Published: Jan 10, 2026
- Affected: from 0.6.4, fixed in 0.12.0.
- Fixed in 0.12.0 (released Dec 3, 2025, 38 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-66448](https://cve.now/CVE-2025-66448): vLLM vulnerable to remote code execution via transformers\_utils/get\_config

- Severity: High 7.1
- Published: Dec 1, 2025
- Affected: fixed in 0.11.1.
- Fixed in 0.11.1 (released Nov 19, 2025, 12 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-62372](https://cve.now/CVE-2025-62372): vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs

- Severity: High 8.3
- Published: Nov 21, 2025
- Affected: from 0.5.5, fixed in 0.11.1.
- Fixed in 0.11.1 (released Nov 19, 2025, 2 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-62426](https://cve.now/CVE-2025-62426): vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted \`chat\_template\_kwargs\`

- Severity: Medium 6.5
- Published: Nov 21, 2025
- Affected: from 0.5.5, fixed in 0.11.1.
- Fixed in 0.11.1 (released Nov 19, 2025, 2 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-62164](https://cve.now/CVE-2025-62164): VLLM deserialization vulnerability leading to DoS and potential RCE

- Severity: High 8.8
- Published: Nov 21, 2025
- Affected: from 0.10.2, fixed in 0.11.1.
- Fixed in 0.11.1 (released Nov 19, 2025, 2 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-6242](https://cve.now/CVE-2025-6242): Vllm: server side request forgery (ssrf) in mediaconnector

- Severity: High 7.1
- Published: Oct 7, 2025
- Affected: from 0.5.0, fixed in 0.11.0.
- Fixed in 0.11.0 (released Oct 4, 2025, 3 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-59425](https://cve.now/CVE-2025-59425): vLLM vulnerable to timing attack at bearer auth

- Severity: High 7.5
- Published: Oct 7, 2025
- Affected: fixed in 0.11.0.
- Fixed in 0.11.0 (released Oct 4, 2025, 3 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-48956](https://cve.now/CVE-2025-48956): vLLM API endpoints vulnerable to Denial of Service Attacks

- Severity: High 7.5
- Published: Aug 21, 2025
- Affected: from 0.1.0, fixed in 0.10.1.1.
- Fixed in 0.10.1.1 (released Aug 20, 2025, 1 day before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-48944](https://cve.now/CVE-2025-48944): vLLM Tool Schema allows DoS via Malformed pattern and type Fields

- Severity: Medium 6.5
- Published: May 30, 2025
- Affected: from 0.8.0, fixed in 0.9.0.
- Fixed in 0.9.0 (released May 28, 2025, 2 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-48943](https://cve.now/CVE-2025-48943): vLLM allows clients to crash the openai server with invalid regex

- Severity: Medium 6.5
- Published: May 30, 2025
- Affected: from 0.8.0, fixed in 0.9.0.
- Fixed in 0.9.0 (released May 28, 2025, 2 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-48942](https://cve.now/CVE-2025-48942): vLLM DOS: Remotely kill vllm over http with invalid JSON schema

- Severity: Medium 6.5
- Published: May 30, 2025
- Affected: from 0.8.0, fixed in 0.9.0.
- Fixed in 0.9.0 (released May 28, 2025, 2 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-48887](https://cve.now/CVE-2025-48887): vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in \`pythonic\_tool\_parser.py\`

- Severity: Medium 6.5
- Published: May 30, 2025
- Affected: from 0.6.4, fixed in 0.9.0; from 0.6.4, fixed in 0.9.0.

### [CVE-2025-46722](https://cve.now/CVE-2025-46722): vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

- Severity: Medium 4.2
- Published: May 29, 2025
- Affected: fixed in 0.9.0; from 0.7.0, fixed in 0.9.0.
- Fixed in 0.9.0 (released May 28, 2025, 1 day before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-46570](https://cve.now/CVE-2025-46570): vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel

- Severity: Low 2.6
- Published: May 29, 2025
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released May 28, 2025, 1 day before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-47277](https://cve.now/CVE-2025-47277): vLLM Allows Remote Code Execution via PyNcclPipe Communication Service

- Severity: Critical 9.8
- Published: May 20, 2025
- Affected: from 0.6.5, fixed in 0.8.5.
- Fixed in 0.8.5 (released Apr 28, 2025, 22 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-30165](https://cve.now/CVE-2025-30165): Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration

- Severity: High 8.0
- Published: May 6, 2025
- Affected: from 0.5.2, fixed in 0.10.0.
- Fixed in 0.10.0 (released Jul 25, 2025, 80 days after disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-32444](https://cve.now/CVE-2025-32444): vLLM Vulnerable to Remote Code Execution via Mooncake Integration

- Severity: Critical 10.0
- Published: Apr 30, 2025
- Affected: from 0.6.5, fixed in 0.8.5; from 0.6.5, fixed in 0.8.5.

### [CVE-2025-46560](https://cve.now/CVE-2025-46560): vLLM phi4mm: Quadratic Time Complexity in Input Token Processing​ leads to denial of service

- Severity: Medium 6.5
- Published: Apr 30, 2025
- Affected: from 0.8.0, fixed in 0.8.5.
- Fixed in 0.8.5 (released Apr 28, 2025, 2 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-30202](https://cve.now/CVE-2025-30202): Data exposure via ZeroMQ on multi-node vLLM deployment

- Severity: High 7.5
- Published: Apr 30, 2025
- Affected: from 0.5.2, fixed in 0.8.5.
- Fixed in 0.8.5 (released Apr 28, 2025, 2 days before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2024-11041](https://cve.now/CVE-2024-11041): Remote Code Execution in vllm-project/vllm

- Severity: Critical 9.8
- Published: Mar 20, 2025
- Affected: through 0.6.2.
- Fixed in 0.6.3 (released Oct 14, 2024, 157 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 0.33.0, is not affected.

### [CVE-2024-9053](https://cve.now/CVE-2024-9053): Remote Code Execution in vllm-project/vllm

- Severity: Critical 9.8
- Published: Mar 20, 2025
- Affected: through 0.6.0.
- Fixed in 0.6.1 (released Sep 11, 2024, 190 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-29783](https://cve.now/CVE-2025-29783): vLLM Allows Remote Code Execution via Mooncake Integration

- Severity: Critical 9.1
- Published: Mar 19, 2025
- Affected: from 0.6.5, fixed in 0.8.0.
- Fixed in 0.8.0 (released Mar 18, 2025, 1 day before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-29770](https://cve.now/CVE-2025-29770): vLLM denial of service via outlines unbounded cache on disk

- Severity: Medium 6.5
- Published: Mar 19, 2025
- Affected: fixed in 0.8.0.
- Fixed in 0.8.0 (released Mar 18, 2025, 1 day before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-25183](https://cve.now/CVE-2025-25183): vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cache

- Severity: Low 2.6
- Published: Feb 7, 2025
- Affected: fixed in 0.7.2.
- Fixed in 0.7.2 (released Feb 6, 2025, 1 day before disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2025-24357](https://cve.now/CVE-2025-24357): vLLM allows a malicious model RCE by torch.load in hf\_model\_weights\_iterator

- Severity: High 7.5
- Published: Jan 27, 2025
- Affected: fixed in 0.7.0.
- Fixed in 0.7.0 (released Jan 27, 2025, the day of disclosure).
- The latest release, 0.33.0, is not affected.

### [CVE-2024-8939](https://cve.now/CVE-2024-8939): Vllm: denials of service in vllm json web api

- Severity: Medium 6.2
- Published: Sep 17, 2024
- Affected: through 0.5.0.post1.
- Fixed in 0.5.1 (released Jul 6, 2024, 73 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 0.33.0, is not affected.

### [CVE-2024-8768](https://cve.now/CVE-2024-8768): Vllm: a completions api request with an empty prompt will crash the vllm api server.

- Severity: High 7.5
- Published: Sep 17, 2024
- Affected: fixed in 0.5.5.
- Fixed in 0.5.5 (released Aug 23, 2024, 25 days before disclosure).
- The latest release, 0.33.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/vllm
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.