[ Vendor · 30 CVEs ]
vllm-project
CVEs affecting vllm-project published in the last 30 days, plus any vllm-project CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114053 | 21 Oct 2026 | CVSS 8.1 | vllm-project vllmvLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting… | |
| CVE-2026-114054 | 21 Oct 2026 | CVSS 6.5 | vllm-project vllmvLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying… | |
| CVE-2026-114055 | 21 Oct 2026 | CVSS 7.5 | vllm-project vllmvLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor… | |
| CVE-2026-114049 | 21 Oct 2026 | CVSS 3.7 | vllm-project vllmvLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by… | |
| CVE-2026-114050 | 21 Oct 2026 | CVSS 7.5 | vllm-project vllmvLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine… | |
| CVE-2026-114051 | 21 Oct 2026 | CVSS 7.5 | vllm-project vllmvLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input… | |
| CVE-2026-114052 | 21 Oct 2026 | CVSS 7.5 | vllm-project vllmvLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct… | |
| CVE-2026-109311 | 12 Oct 2026 | CVSS 6.5 | vllm-project vllmvLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap… | |
| CVE-2026-105922 | 6 Oct 2026 | CVSS 4.3 | vllm-project vLLMA security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file… | |
| CVE-2026-105775 | 6 Oct 2026 | CVSS 4.3 | vllm-project vLLMA security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file… | |
| CVE-2026-105754 | 5 Oct 2026 | CVSS 6.5 | vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied featuresvLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated… | Fix |
| CVE-2026-105755 | 5 Oct 2026 | CVSS 4.2 | vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank… | Fix |
| CVE-2026-105756 | 5 Oct 2026 | CVSS 6.5 | vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of servicevLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt… | Fix |
| CVE-2026-105757 | 5 Oct 2026 | CVSS 6.5 | vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped… | Fix |
| CVE-2026-105758 | 5 Oct 2026 | CVSS 5.3 | vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reachvLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes… | Fix |
| CVE-2026-105759 | 5 Oct 2026 | CVSS 7.5 | vllm-project vllmvLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw… | Fix |
| CVE-2026-105760 | 5 Oct 2026 | CVSS 5.3 | vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustionvLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to… | Fix |
| CVE-2026-105752 | 5 Oct 2026 | CVSS 3.1 | vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oraclevLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses"… | Fix |
| CVE-2026-105753 | 5 Oct 2026 | CVSS 6.5 | vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine corevLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash… | Fix |
| CVE-2026-103241 | 30 Sep 2026 | CVSS 7.5 | vllm-project vLLMA flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of… | Fix |
| CVE-2026-100654 | 26 Sep 2026 | CVSS 6.5 | vllm-project vllmvLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but… | |
| CVE-2026-100647 | 26 Sep 2026 | CVSS 7.5 | vllm-project vllmvLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API… | |
| CVE-2026-100648 | 26 Sep 2026 | CVSS 5.3 | vllm-project vllmvllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to… | |
| CVE-2026-100649 | 26 Sep 2026 | CVSS 5.3 | vllm-project vllmvLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows… | |
| CVE-2026-100650 | 26 Sep 2026 | CVSS 6.5 | vllm-project vllmvLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the… | Fix |
| CVE-2026-100651 | 26 Sep 2026 | CVSS 6.5 | vllm-project vllmvLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request… | |
| CVE-2026-100652 | 26 Sep 2026 | CVSS 7.5 | vllm-project vllmvLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing… | |
| CVE-2026-100653 | 26 Sep 2026 | CVSS 6.5 | vllm-project vllmvLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin… | Fix |
| CVE-2025-62426 | 21 Nov 2025 | CVSS 6.5 | vllm-project vllmvLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the /v1/chat/completions and /tokenize… | |
| CVE-2025-46570 | 29 May 2025 | CVSS 2.6 | vllm-project vllmvLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the… |