# cve.now: Vllm-project

The newest entries naming Vllm-project as an affected vendor (up to 200), of 125 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115918](https://cve.now/CVE-2026-115918.md): vLLM: Responses API bypasses trust\_request\_chat\_template for chat\_template\_kwargs (CVSS 6.5)
- [CVE-2026-115917](https://cve.now/CVE-2026-115917.md): vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server (CVSS 3.4)
- [CVE-2026-115916](https://cve.now/CVE-2026-115916.md): vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) (CVSS 6.5)
- [CVE-2026-115915](https://cve.now/CVE-2026-115915.md): vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE (CVSS 8.1)
- [CVE-2026-115914](https://cve.now/CVE-2026-115914.md): vLLM DeepSeek-OCR image processing vulnerable to denial of service (CVSS 6.5)
- [CVE-2026-115913](https://cve.now/CVE-2026-115913.md): vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine (CVSS 6.5)
- [CVE-2026-115912](https://cve.now/CVE-2026-115912.md): vLLM: Public multimodal SHM handle forgery reaches worker-side \`pickle.loads()\` with insecure serialization disabled (CVSS 7.5)
- [CVE-2026-115911](https://cve.now/CVE-2026-115911.md): vLLM: DoS via unbounded chat\_template Jinja2 rendering exhausts the renderer thread pool (CVSS 6.5)
- [CVE-2026-116181](https://cve.now/CVE-2026-116181.md): vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop\_token\_ids (CVSS 7.1)
- [CVE-2026-116180](https://cve.now/CVE-2026-116180.md): vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors (CVSS 8.3)
- [CVE-2026-116179](https://cve.now/CVE-2026-116179.md): vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media\_io\_kwargs num\_frames Override (CVSS 8.7)
- [CVE-2026-116178](https://cve.now/CVE-2026-116178.md): vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm\_placeholders (CVSS 8.2)
- [CVE-2026-116177](https://cve.now/CVE-2026-116177.md): vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass (CVSS 8.7)
- [CVE-2026-116176](https://cve.now/CVE-2026-116176.md): vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector (CVSS 8.8)
- [CVE-2026-116175](https://cve.now/CVE-2026-116175.md): vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions (CVSS 7.1)
- [CVE-2026-116174](https://cve.now/CVE-2026-116174.md): vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate (CVSS 8.2)
- [CVE-2026-116173](https://cve.now/CVE-2026-116173.md): vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output\_candidates.token\_ids (CVSS 8.2)
- [CVE-2026-116172](https://cve.now/CVE-2026-116172.md): vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top\_n (CVSS 8.2)
- [CVE-2026-114055](https://cve.now/CVE-2026-114055.md): vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm\_processor\_kwargs (CVSS 8.7)
- [CVE-2026-114054](https://cve.now/CVE-2026-114054.md): vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys (CVSS 7.1)
- [CVE-2026-114053](https://cve.now/CVE-2026-114053.md): vLLM 0.7.3 before 0.31.0 RCE via mm\_processor\_kwargs.code\_revision (CVSS 9.2)
- [CVE-2026-114052](https://cve.now/CVE-2026-114052.md): vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm\_processor\_kwargs (CVSS 8.7)
- [CVE-2026-114051](https://cve.now/CVE-2026-114051.md): vLLM before 0.31.0 Denial of Service via min\_tokens in /inference/v1/generate (CVSS 7.1)
- [CVE-2026-114050](https://cve.now/CVE-2026-114050.md): vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID (CVSS 7.1)
- [CVE-2026-114049](https://cve.now/CVE-2026-114049.md): vLLM before 0.31.0 Stale allowed\_token\_ids Mask via InputBatch.condense (CVSS 6.3)
- [CVE-2026-109311](https://cve.now/CVE-2026-109311.md): vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload (CVSS 7.1)
- [CVE-2026-105922](https://cve.now/CVE-2026-105922.md): vllm-project vLLM Penalty utils.py get\_token\_bin\_counts\_and\_mask denial of service (CVSS 5.3)
- [CVE-2026-105775](https://cve.now/CVE-2026-105775.md): vllm-project vLLM Completions Request mamba\_mixer2.py conv\_ssm\_forward out-of-bounds (CVSS 5.3)
- [CVE-2026-105760](https://cve.now/CVE-2026-105760.md): vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion (CVSS 5.3)
- [CVE-2026-105759](https://cve.now/CVE-2026-105759.md): vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service) (CVSS 5.9)
- [CVE-2026-105758](https://cve.now/CVE-2026-105758.md): vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max\_frames, which the num\_frames ceiling does not reach (CVSS 5.3)
- [CVE-2026-105757](https://cve.now/CVE-2026-105757.md): vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites) (CVSS 6.5)
- [CVE-2026-105756](https://cve.now/CVE-2026-105756.md): vLLM: Loose \`cache\_salt\` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream \`ValueError\` denial of service (CVSS 6.5)
- [CVE-2026-105755](https://cve.now/CVE-2026-105755.md): vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on \`/score\` and \`/rerank\` (CVSS 4.2)
- [CVE-2026-105754](https://cve.now/CVE-2026-105754.md): vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features (CVSS 6.5)
- [CVE-2026-105753](https://cve.now/CVE-2026-105753.md): vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core (CVSS 6.5)
- [CVE-2026-105752](https://cve.now/CVE-2026-105752.md): vLLM: Harmony tool continuations drop \`cache\_salt\` — restoring a cross-tenant prefix-cache membership oracle (CVSS 3.1)
- [CVE-2026-103241](https://cve.now/CVE-2026-103241.md): vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service (CVSS 6.9)
- [CVE-2026-100654](https://cve.now/CVE-2026-100654.md): vLLM before 0.29.0 Denial of Service via out-of-range stop\_token\_ids (CVSS 7.1)
- [CVE-2026-100653](https://cve.now/CVE-2026-100653.md): vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation (CVSS 8.3)
- [CVE-2026-100652](https://cve.now/CVE-2026-100652.md): vLLM 0.22.0 through 0.23.0 Denial of Service via stop\_token\_ids (CVSS 8.2)
- [CVE-2026-100651](https://cve.now/CVE-2026-100651.md): vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass (CVSS 7.1)
- [CVE-2026-100650](https://cve.now/CVE-2026-100650.md): vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization (CVSS 7.1)
- [CVE-2026-100649](https://cve.now/CVE-2026-100649.md): vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass (CVSS 6.3)
- [CVE-2026-100648](https://cve.now/CVE-2026-100648.md): vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding (CVSS 6.9)
- [CVE-2026-100647](https://cve.now/CVE-2026-100647.md): vLLM before 0.29.0 CPU Exhaustion via unbounded cache\_salt (CVSS 6.9)
- [CVE-2026-94627](https://cve.now/CVE-2026-94627.md): vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision (CVSS 8.7)
- [CVE-2026-94626](https://cve.now/CVE-2026-94626.md): vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp\_size (CVSS 8.7)
- [CVE-2026-94625](https://cve.now/CVE-2026-94625.md): vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders (CVSS 6.9)
- [CVE-2026-94624](https://cve.now/CVE-2026-94624.md): vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions (CVSS 8.7)
- [CVE-2026-94623](https://cve.now/CVE-2026-94623.md): vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure (CVSS 8.7)
- [CVE-2026-94622](https://cve.now/CVE-2026-94622.md): vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata (CVSS 8.7)
- [CVE-2026-93989](https://cve.now/CVE-2026-93989.md): vLLM through 0.29.0 Cross-Request Logits Corruption via bad\_words (CVSS 2.3)
- [CVE-2026-93841](https://cve.now/CVE-2026-93841.md): vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs (CVSS 6.3)
- [CVE-2026-93840](https://cve.now/CVE-2026-93840.md): vLLM before 0.29.0 Cross-Request Logits Corruption via allowed\_token\_ids (CVSS 6.3)
- [CVE-2026-93592](https://cve.now/CVE-2026-93592.md): vLLM before 0.28.0 Denial of Service via negative token ID (CVSS 8.7)
- [CVE-2026-93436](https://cve.now/CVE-2026-93436.md): vLLM through 0.29.0 Memory Exhaustion via Rejected Requests (CVSS 8.7)
- [CVE-2026-69147](https://cve.now/CVE-2026-69147.md): vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation (CVSS 6.5)
- [CVE-2026-57173](https://cve.now/CVE-2026-57173.md): vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions (CVSS 6.5)
- [CVE-2026-92365](https://cve.now/CVE-2026-92365.md): vllm-project vllm thinking\_budget\_state.py algorithmic complexity (CVSS 5.3)
- [CVE-2026-92220](https://cve.now/CVE-2026-92220.md): vllm-project vLLM MoRIIO Acknowledgement moriio\_connector.py MoRIIOWrapper.\_handle\_release\_message resource consumption (CVSS 6.9)
- [CVE-2026-90878](https://cve.now/CVE-2026-90878.md): vllm-project vLLM Jinja Template Rendering completions resource consumption (CVSS 5.3)
- [CVE-2026-90713](https://cve.now/CVE-2026-90713.md): vllm-project vLLM tiktoken vocab File mod.rs new denial of service (CVSS 4.8)
- [CVE-2026-90555](https://cve.now/CVE-2026-90555.md): vLLM before 0.28.0 Denial of Service via Audio Header (CVSS 7.1)
- [CVE-2026-90554](https://cve.now/CVE-2026-90554.md): vLLM before 0.28.0 Denial of Service via audio extraction (CVSS 6.9)
- [CVE-2026-90553](https://cve.now/CVE-2026-90553.md): vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor (CVSS 8.5)
- [CVE-2026-78684](https://cve.now/CVE-2026-78684.md): vLLM before 0.27.0 Denial of Service via DeepStream Backend (CVSS 6.9)
- [CVE-2026-73560](https://cve.now/CVE-2026-73560.md): vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor \`\_fetch\_image\` and audio loader bypass MediaConnector protections (CVSS 6.5)
- [CVE-2026-71486](https://cve.now/CVE-2026-71486.md): vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds (CVSS 4.3)
- [CVE-2026-73559](https://cve.now/CVE-2026-73559.md): vLLM: Completion prompt lists fan out into unbounded engine requests (CVSS 6.5)
- [CVE-2026-73558](https://cve.now/CVE-2026-73558.md): vLLM: Cross-User Data Leak Vulnerability (CVSS 5.3)
- [CVE-2026-73557](https://cve.now/CVE-2026-73557.md): vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts (CVSS 6.3)
- [CVE-2026-73556](https://cve.now/CVE-2026-73556.md): vLLM: ReDoS via structured\_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574 (CVSS 5.3)
- [CVE-2026-73555](https://cve.now/CVE-2026-73555.md): vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages (CVSS 5.3)
- [CVE-2026-55514](https://cve.now/CVE-2026-55514.md): vLLM denial of service via prompt embeds on M-RoPE models (CVSS 7.1)
- [CVE-2026-55574](https://cve.now/CVE-2026-55574.md): vLLM: ReDoS via structured\_outputs.regex compiled without timeout in xgrammar and outlines backends (CVSS 8.7)
- [CVE-2026-54234](https://cve.now/CVE-2026-54234.md): vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection (CVSS 7.5)
- [CVE-2026-55646](https://cve.now/CVE-2026-55646.md): vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit (CVSS 6.5)
- [CVE-2026-47155](https://cve.now/CVE-2026-47155.md): vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors (CVSS 6.5)
- [CVE-2026-41523](https://cve.now/CVE-2026-41523.md): vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution (CVSS 7.5)
- [CVE-2026-54232](https://cve.now/CVE-2026-54232.md): vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile (CVSS 8.8)
- [CVE-2026-54233](https://cve.now/CVE-2026-54233.md): vLLM: OOM Denial of Service via Audio Decompression Bomb (CVSS 6.5)
- [CVE-2026-54236](https://cve.now/CVE-2026-54236.md): vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router (CVSS 5.3)
- [CVE-2026-54235](https://cve.now/CVE-2026-54235.md): vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels (CVSS 6.9)
- [CVE-2026-48746](https://cve.now/CVE-2026-48746.md): vLLM: OpenAI auth bypass (CVSS 9.1)
- [CVE-2026-53923](https://cve.now/CVE-2026-53923.md): vLLM GGUF Kernels: int64\_t to int truncation of tensor dimensions causes GPU buffer overflow (CVSS 5.3)
- [CVE-2026-12491](https://cve.now/CVE-2026-12491.md): Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations (CVSS 4.8)
- [CVE-2026-5497](https://cve.now/CVE-2026-5497.md): Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm (CVSS 7.5)
- [CVE-2026-4944](https://cve.now/CVE-2026-4944.md): Hardcoded trust\_remote\_code=True in vllm-project/vllm Bypasses User Security Control (CVSS 8.8)
- [CVE-2026-9540](https://cve.now/CVE-2026-9540.md): vllm-project vllm OpenAI-compatible Serving Path denial of service (CVSS 6.9)
- [CVE-2026-44223](https://cve.now/CVE-2026-44223.md): vLLM: extract\_hidden\_states speculative decoding crashes server on any request with penalty parameters (CVSS 6.5)
- [CVE-2026-44222](https://cve.now/CVE-2026-44222.md): vLLM: Remote DoS via Special-Token Placeholders (CVSS 6.5)
- [CVE-2026-34756](https://cve.now/CVE-2026-34756.md): vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded \`n\` Parameter in OpenAI API Server (CVSS 6.5)
- [CVE-2026-34755](https://cve.now/CVE-2026-34755.md): vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing (CVSS 6.5)
- [CVE-2026-34753](https://cve.now/CVE-2026-34753.md): vLLM affected by Server-Side Request Forgery (SSRF) in \`download\_bytes\_from\_url \` (CVSS 5.4)
- [CVE-2026-34760](https://cve.now/CVE-2026-34760.md): vLLM: Downmix Implementation Differences as Attack Vectors Against Audio AI Models (CVSS 5.9)
- [CVE-2026-27893](https://cve.now/CVE-2026-27893.md): vLLM's hardcoded trust\_remote\_code=True in NemotronVL and KimiK25 bypasses user security opt-out (CVSS 8.8)
- [CVE-2026-25960](https://cve.now/CVE-2026-25960.md): SSRF Protection Bypass in vLLM (CVSS 7.1)
- [CVE-2026-22778](https://cve.now/CVE-2026-22778.md): vLLM leaks a heap address when PIL throws an error (CVSS 9.8)
- [CVE-2026-24779](https://cve.now/CVE-2026-24779.md): vLLM vulnerable to Server-Side Request Forgery (SSRF) in \`MediaConnector\` (CVSS 7.1)
- [CVE-2026-22807](https://cve.now/CVE-2026-22807.md): vLLM affected by RCE via auto\_map dynamic module loading during model initialization (CVSS 8.8)
- [CVE-2026-22773](https://cve.now/CVE-2026-22773.md): vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions (CVSS 6.5)
- [CVE-2025-66448](https://cve.now/CVE-2025-66448.md): vLLM vulnerable to remote code execution via transformers\_utils/get\_config (CVSS 7.1)
- [CVE-2025-62372](https://cve.now/CVE-2025-62372.md): vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs (CVSS 8.3)
- [CVE-2025-62426](https://cve.now/CVE-2025-62426.md): vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted \`chat\_template\_kwargs\` (CVSS 6.5)
- [CVE-2025-62164](https://cve.now/CVE-2025-62164.md): VLLM deserialization vulnerability leading to DoS and potential RCE (CVSS 8.8)
- [CVE-2025-59425](https://cve.now/CVE-2025-59425.md): vLLM vulnerable to timing attack at bearer auth (CVSS 7.5)
- [CVE-2025-48956](https://cve.now/CVE-2025-48956.md): vLLM API endpoints vulnerable to Denial of Service Attacks (CVSS 7.5)
- [CVE-2025-48944](https://cve.now/CVE-2025-48944.md): vLLM Tool Schema allows DoS via Malformed pattern and type Fields (CVSS 6.5)
- [CVE-2025-48943](https://cve.now/CVE-2025-48943.md): vLLM allows clients to crash the openai server with invalid regex (CVSS 6.5)
- [CVE-2025-48942](https://cve.now/CVE-2025-48942.md): vLLM DOS: Remotely kill vllm over http with invalid JSON schema (CVSS 6.5)
- [CVE-2025-48887](https://cve.now/CVE-2025-48887.md): vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in \`pythonic\_tool\_parser.py\` (CVSS 6.5)
- [CVE-2025-46722](https://cve.now/CVE-2025-46722.md): vLLM has a Weakness in MultiModalHasher Image Hashing Implementation (CVSS 4.2)
- [CVE-2025-46570](https://cve.now/CVE-2025-46570.md): vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel (CVSS 2.6)
- [CVE-2025-47277](https://cve.now/CVE-2025-47277.md): vLLM Allows Remote Code Execution via PyNcclPipe Communication Service (CVSS 9.8)
- [CVE-2025-30165](https://cve.now/CVE-2025-30165.md): Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration (CVSS 8.0)
- [CVE-2025-32444](https://cve.now/CVE-2025-32444.md): vLLM Vulnerable to Remote Code Execution via Mooncake Integration (CVSS 10.0)
- [CVE-2025-46560](https://cve.now/CVE-2025-46560.md): vLLM phi4mm: Quadratic Time Complexity in Input Token Processing​ leads to denial of service (CVSS 6.5)
- [CVE-2025-30202](https://cve.now/CVE-2025-30202.md): Data exposure via ZeroMQ on multi-node vLLM deployment (CVSS 7.5)
- [CVE-2024-11041](https://cve.now/CVE-2024-11041.md): Remote Code Execution in vllm-project/vllm (CVSS 9.8)
- [CVE-2024-9053](https://cve.now/CVE-2024-9053.md): Remote Code Execution in vllm-project/vllm (CVSS 9.8)
- [CVE-2025-29783](https://cve.now/CVE-2025-29783.md): vLLM Allows Remote Code Execution via Mooncake Integration (CVSS 9.1)
- [CVE-2025-29770](https://cve.now/CVE-2025-29770.md): vLLM denial of service via outlines unbounded cache on disk (CVSS 6.5)
- [CVE-2025-25183](https://cve.now/CVE-2025-25183.md): vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cache (CVSS 2.6)
- [CVE-2025-24357](https://cve.now/CVE-2025-24357.md): vLLM allows a malicious model RCE by torch.load in hf\_model\_weights\_iterator (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/vllm-project
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.