vllm vulnerabilities (PyPI)
111 vulnerabilities.
-
vllmPyPI vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs 6.5 Medium -
vllmPyPI vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server 3.4 Low -
vllmPyPI vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) 6.5 Medium -
vllmPyPI vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE 8.1 High -
vllmPyPI vLLM DeepSeek-OCR image processing vulnerable to denial of service 6.5 Medium -
vllmPyPI vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine 6.5 Medium -
vllmPyPI vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled 7.5 High -
vllmPyPI vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool 6.5 Medium -
vllmPyPI vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders 8.2 High -
vllmPyPI vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass 8.7 High -
vllmPyPI vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector 8.8 High -
vllmPyPI vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids 8.2 High -
vllmPyPI vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs 8.7 High -
vllmPyPI vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision 9.2 Critical -
vllmPyPI vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID 7.1 High -
vllmPyPI vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service 5.3 Medium -
vllmPyPI vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion 5.3 Medium -
vllmPyPI vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service) 5.9 Medium -
vllmPyPI vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach 5.3 Medium -
vllmPyPI vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites) 6.5 Medium -
vllmPyPI vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service 6.5 Medium -
vllmPyPI vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank` 4.2 Medium -
vllmPyPI vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features 6.5 Medium -
vllmPyPI vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core 6.5 Medium -
vllmPyPI vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle 3.1 Low -
vllmPyPI vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service 6.9 Medium -
vllmPyPI vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation 8.3 High -
vllmPyPI vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids 8.2 High -
vllmPyPI vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization 7.1 High -
vllmPyPI vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size 8.7 High -
vllmPyPI vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders 6.9 Medium -
vllmPyPI vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions 8.7 High -
vllmPyPI vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure 8.7 High -
vllmPyPI vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata 8.7 High -
vllmPyPI vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words 2.3 Low -
vllmPyPI vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs 6.3 Medium -
vllmPyPI vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids 6.3 Medium -
vllmPyPI vLLM before 0.28.0 Denial of Service via negative token ID 8.7 High -
vllmPyPI vLLM through 0.29.0 Memory Exhaustion via Rejected Requests 8.7 High -
vllmPyPI vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation 6.5 Medium -
vllmPyPI vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions 6.5 Medium -
vllmPyPI vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor 8.5 High -
vllmPyPI vLLM before 0.27.0 Denial of Service via DeepStream Backend 6.9 Medium -
vllmPyPI vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections 6.5 Medium -
vllmPyPI vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds 4.3 Medium -
vllmPyPI vLLM: Completion prompt lists fan out into unbounded engine requests 6.5 Medium -
vllmPyPI vLLM: Cross-User Data Leak Vulnerability 5.3 Medium -
vllmPyPI vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts 6.3 Medium -
vllmPyPI vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574 5.3 Medium -
vllmPyPI vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages 5.3 Medium - Show olderLoading…