Vllm-Project Vllm vulnerabilities

CVE-2026-53923 [HIGH] CWE-200 CVE-2026-53923: vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0 vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0, integer truncation of tensor dimensions in vLLM's GGUF dequantize kernels (csrc/quantization/gguf/gguf_kernel.cu) causes partial tensor processing. The output tensor is allocated at full size via torch::empty (uninitialized memory), but the dequantize

CVE-2025-46722 [HIGH] CWE-1023 CVE-2025-46722: vLLM is an inference and serving engine for large language models (LLMs). In versions starting from vLLM is an inference and serving engine for large language models (LLMs). In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image objects using only obj.tobytes(), which returns only t

CVE-2026-73560 [MEDIUM] CWE-918 CVE-2026-73560: vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMu vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_

CVE-2025-30202 [HIGH] CWE-770 CVE-2025-30202: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions start vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vulnerable to denial of service and data exposure via ZeroMQ on multi-node vLLM deployment. In a multi-node vLLM deployment, vLLM uses ZeroMQ for some multi-node communication purposes. The primary vLLM host opens a

CVE-2025-48956 [HIGH] CWE-400 CVE-2025-48956: vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.10. vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.10.1.1, a Denial of Service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory exhaustion, potentially leading to a crash or unresponsiveness. The atta

CVE-2026-55646 [MEDIUM] CWE-400 CVE-2026-55646: vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/au vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/translations routes call request.file.read() to fully materialize an uploaded audio file into memory before vLLM checks the documented VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed upload size limit (default 25 MB) later

CVE-2026-34756 [MEDIUM] CWE-770 CVE-2026-34756: vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.19. vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the n parameter in the ChatCompletionRequest and CompletionRequest Pydantic models, an unauthenticated attacker can s

CVE-2026-34755 [MEDIUM] CWE-770 CVE-2026-34755: vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19. vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19.0, the VideoMediaIO.load_base64() method at vllm/multimodal/media/video.py splits video/jpeg data URLs by comma to extract individual JPEG frames, but does not enforce a frame count limit. The num_frames parameter (default: 32), which is enforced by t

CVE-2025-62426 [MEDIUM] CWE-770 CVE-2025-62426: vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to befo vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the /v1/chat/completions and /tokenize endpoints allow a chat_template_kwargs request parameter that is used in the code before it is properly validated against the chat template. With the right chat_template_kwargs parameters, it is possib

CVE-2026-47155 [MEDIUM] CWE-345 CVE-2026-47155: vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM's re vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM's revision pinning controls do not consistently apply to all artifacts loaded for a model. A deployment that supplies --revision or --code-revision can still load dynamic code, GGUF files, image processors, retrieval side weights, or same-repository subfo

CVE-2026-34760 [HIGH] CWE-20 CVE-2026-34760: vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to befo vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa defaults to using numpy.mean for mono downmixing (to_mono), while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results in inconsistency between audio heard by humans (e.g

CVE-2026-55514 [MEDIUM] CWE-617 CVE-2026-55514: vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a /v1/completions request with a model using M-RoPE causes EngineCore to fail an assertion and fatally crash, shutting down the entire server application. Any remote user who is authorized to make a /v1/completions request can make

CVE-2026-73559 [MEDIUM] CWE-400 CVE-2026-73559: vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1 vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded list[str] or list[list[int]], prompt_to_seq() in vllm/renderers/inputs/preprocess.py and OnlineRenderer.preprocess_completion() in vllm/

CVE-2026-44223 [MEDIUM] CWE-131 CVE-2026-44223: vLLM is an inference and serving engine for large language models (LLMs). From 0.18.0 to before 0.20 vLLM is an inference and serving engine for large language models (LLMs). From 0.18.0 to before 0.20.0, the extract_hidden_states speculative decoding proposer in vLLM returns a tensor with an incorrect shape after the first decode step, causing a RuntimeError that crashes the EngineCore process. The crash is triggered when any request in the batch

CVE-2025-29770 [MEDIUM] CWE-770 CVE-2025-29770: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. The outlines l vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. The outlines library is one of the backends used by vLLM to support structured output (a.k.a. guided decoding). Outlines provides an optional cache for its compiled grammars on the local filesystem. This cache has been on by default in vLLM. Outlines is also availa

CVE-2026-54233 [MEDIUM] CWE-409 CVE-2026-54233: vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, vLLM's vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, vLLM's /v1/audio/transcriptions endpoint limits compressed upload size but not decoded PCM output. A 25MB OPUS file expands to ~14.9GB of float32 PCM at decode time. This vulnerability is fixed in 0.23.1rc0.

CVE-2025-48944 [MEDIUM] CWE-20 CVE-2025-48944: vLLM is an inference and serving engine for large language models (LLMs). In version 0.8.0 up to but vLLM is an inference and serving engine for large language models (LLMs). In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the "pattern" and "type" fields when the tools functionality is invoked. These inputs are not validated before bei

CVE-2026-54235 [MEDIUM] CWE-1287 CVE-2026-54235: vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll tem vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (), which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagate to GPU sampling kernels, where they produce und

CVE-2025-62372 [MEDIUM] CWE-129 CVE-2025-62372: vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to befo vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, users can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct ndim but incorrect shape (e.g. hidden dimension is wrong), regardless of whether the model is intended to support such inputs (as

CVE-2026-34753 [MEDIUM] CWE-918 CVE-2026-34753: vLLM is an inference and serving engine for large language models (LLMs). From 0.16.0 to before 0.19 vLLM is an inference and serving engine for large language models (LLMs). From 0.16.0 to before 0.19.0, a server-side request forgery (SSRF) vulnerability in download_bytes_from_url allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain