Skip to contentVllm-project vulnerabilities
Newest
- vllm, red hat ai inference server, ai inference server 3.2 +5 more +7 morevLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`CVE-2026-24779Fix available7.1 High
- vllm, red hat ai inference server, ai inference server 3.2 +6 more +8 morevLLM affected by RCE via auto_map dynamic module loading during model initializationCVE-2026-22807Public exploitFix available8.8 High
- vllmvLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensionsCVE-2026-22773Fix available6.5 Medium
- vllm, red hat ai inference server, enterprise linux ai (rhel ai) 3 +1 more +3 morevLLM - Denial of Service via Unvalidated Multimodal EmbeddingsCVE-2026-56340Fix available8.7 High
- vllmvLLM vulnerable to remote code execution via transformers_utils/get_configCVE-2025-66448Fix available7.1 High
- vllmvLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`CVE-2025-62426Fix available6.5 Medium
- vllmvLLM vulnerable to DoS with incorrect shape of multimodal embedding inputsCVE-2025-62372Fix available8.3 High
- vllmVLLM deserialization vulnerability leading to DoS and potential RCECVE-2025-62164Fix available8.8 High
- vllmvLLM vulnerable to timing attack at bearer authCVE-2025-59425Fix available7.5 High
- vllmvLLM API endpoints vulnerable to Denial of Service AttacksCVE-2025-48956Fix available7.5 High
- vllmvLLM Tool Schema allows DoS via Malformed pattern and type FieldsCVE-2025-48944Fix available6.5 Medium
- vllmvLLM allows clients to crash the openai server with invalid regexCVE-2025-48943Fix available6.5 Medium
- vllmvLLM DOS: Remotely kill vllm over http with invalid JSON schemaCVE-2025-48942Fix available6.5 Medium
- vllmvLLM has a Weakness in MultiModalHasher Image Hashing ImplementationCVE-2025-46722Fix available4.2 Medium
- vllmvLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-ChannelCVE-2025-46570Fix available2.6 Low
- vllmvllm - Regular Expression Denial of Service in Multiple ComponentsCVE-2025-71379Fix available5.3 Medium
- vllmvLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`CVE-2025-48887Fix available6.5 Medium
- vllmvLLM Allows Remote Code Execution via PyNcclPipe Communication ServiceCVE-2025-47277Fix available9.8 Critical
- vllmRemote Code Execution Vulnerability in vLLM Multi-Node Cluster ConfigurationCVE-2025-30165Fix available8.0 High
- vllmvLLM phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of serviceCVE-2025-46560Fix available6.5 Medium
- vllmvLLM Vulnerable to Remote Code Execution via Mooncake IntegrationCVE-2025-32444Fix available10.0 Critical
- vllmData exposure via ZeroMQ on multi-node vLLM deploymentCVE-2025-30202Fix available7.5 High
- vllm, vllm-project vllm-project/vllm +1 moreRemote Code Execution in vllm-project/vllmCVE-2024-110419.8 Critical
- vllm-project vllm, vllm-project/vllm +1 moreRemote Code Execution in vllm-project/vllmCVE-2024-90539.8 Critical
- vllmvLLM Allows Remote Code Execution via Mooncake IntegrationCVE-2025-29783Fix available9.1 Critical
- vllmvLLM denial of service via outlines unbounded cache on diskCVE-2025-29770Fix available6.5 Medium
- vllmvLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cacheCVE-2025-25183Fix available2.6 Low
- vllmvLLM allows a malicious model RCE by torch.load in hf_model_weights_iteratorCVE-2025-24357Fix available7.5 High