Vllm-project vulnerabilities
125 CVEs and advisories name Vllm-project as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-115918vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
- CVE-2026-115917vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
- CVE-2026-115916vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
- CVE-2026-115915vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
- CVE-2026-115914vLLM DeepSeek-OCR image processing vulnerable to denial of service
- CVE-2026-115913vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine
- CVE-2026-115912vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
- CVE-2026-115911vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
- CVE-2026-116181vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids
- CVE-2026-116180vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors
- CVE-2026-116179vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override
- CVE-2026-116178vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders
- CVE-2026-116177vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass
- CVE-2026-116176vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector
- CVE-2026-116175vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions
- CVE-2026-116174vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate
- CVE-2026-116173vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids
- CVE-2026-116172vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n
- CVE-2026-114055vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
- CVE-2026-114054vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys
- CVE-2026-114053vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision
- CVE-2026-114052vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs
- CVE-2026-114051vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate
- CVE-2026-114050vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID
- CVE-2026-114049vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense
- CVE-2026-109311vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload
- CVE-2026-105922vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service
- CVE-2026-105775vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds
- CVE-2026-105760vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion
- CVE-2026-105759vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)