Skip to contentVllm vulnerabilities
Newest
- vllmvLLM vulnerable to timing attack at bearer authCVE-2025-59425Fix available7.5 High
- vllmvLLM API endpoints vulnerable to Denial of Service AttacksCVE-2025-48956Fix available7.5 High
- vllmvLLM Tool Schema allows DoS via Malformed pattern and type FieldsCVE-2025-48944Fix available6.5 Medium
- vllmvLLM allows clients to crash the openai server with invalid regexCVE-2025-48943Fix available6.5 Medium
- vllmvLLM DOS: Remotely kill vllm over http with invalid JSON schemaCVE-2025-48942Fix available6.5 Medium
- vllmvLLM has a Weakness in MultiModalHasher Image Hashing ImplementationCVE-2025-46722Fix available4.2 Medium
- vllmvLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-ChannelCVE-2025-46570Fix available2.6 Low
- vllmvllm - Regular Expression Denial of Service in Multiple ComponentsCVE-2025-71379Fix available5.3 Medium
- vllmvLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`CVE-2025-48887Fix available6.5 Medium
- vllmvLLM Allows Remote Code Execution via PyNcclPipe Communication ServiceCVE-2025-47277Fix available9.8 Critical
- vllmRemote Code Execution Vulnerability in vLLM Multi-Node Cluster ConfigurationCVE-2025-30165Fix available8.0 High
- vllmvLLM phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of serviceCVE-2025-46560Fix available6.5 Medium
- vllmvLLM Vulnerable to Remote Code Execution via Mooncake IntegrationCVE-2025-32444Fix available10.0 Critical
- vllmData exposure via ZeroMQ on multi-node vLLM deploymentCVE-2025-30202Fix available7.5 High
- vllm, vllm-project vllm-project/vllm +1 moreRemote Code Execution in vllm-project/vllmCVE-2024-110419.8 Critical
- vllmvLLM Allows Remote Code Execution via Mooncake IntegrationCVE-2025-29783Fix available9.1 Critical
- vllmvLLM denial of service via outlines unbounded cache on diskCVE-2025-29770Fix available6.5 Medium
- vllm aibrixvLLM AIBrix Prefix Caching hash.go random valuesCVE-2025-19532.1 Low
- vllmvLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cacheCVE-2025-25183Fix available2.6 Low
- vllmvLLM allows a malicious model RCE by torch.load in hf_model_weights_iteratorCVE-2025-24357Fix available7.5 High