vLLM vulnerabilities and CVEs

CVE-2026-105752

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

CVE-2026-105753

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

CVE-2026-105754

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

CVE-2026-105755

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

CVE-2026-105756

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

CVE-2026-105757

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

CVE-2026-105758

vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

CVE-2026-105760

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

CVE-2026-69147

vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

CVE-2026-57173

vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

CVE-2026-73558

vLLM: Cross-User Data Leak Vulnerability

CVE-2026-73560

vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

CVE-2026-71486

vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

CVE-2026-73555

vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

CVE-2026-73556

vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

CVE-2026-73557

vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

CVE-2026-73559

vLLM: Completion prompt lists fan out into unbounded engine requests

CVE-2026-55514

vLLM denial of service via prompt embeds on M-RoPE models

CVE-2026-34760

vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models

CVE-2026-54234

vLLM has Remote DoS via Invalid Recovered Token Reinjection

CVE-2026-55574

vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

CVE-2026-55646

vLLM: Speech-to-text upload size limit is enforced after full UploadFile read

CVE-2026-12491

vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

CVE-2026-53923

vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

CVE-2026-54233

vLLM: OOM Denial of Service via Audio Decompression Bomb

CVE-2026-54235

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

CVE-2026-54236

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

CVE-2026-41523

vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

CVE-2026-48746

vLLM: OpenAI auth bypass

CVE-2026-5497

vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method

CVE-2026-47155

vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

CVE-2026-9540

vllm has Improper Resource Shutdown or Release

CVE-2026-44223

vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters

CVE-2026-44222

vLLM Vulnerable to Remote DoS via Special-Token Placeholders

CVE-2026-7141

vLLM makes Use of Uninitialized Resource

CVE-2026-34753

vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `

CVE-2026-34755

vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing

CVE-2026-34756

vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

CVE-2026-27893

vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out

CVE-2026-25960

vLLM has SSRF Protection Bypass

CVE-2026-22778

vLLM has RCE In Video Processing

CVE-2026-24779

vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector

CVE-2026-22807

vLLM affected by RCE via auto_map dynamic module loading during model initialization

CVE-2026-22773

vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions

CVE-2026-56340

vLLM introduced enhanced protection for CVE-2025-62164

CVE-2025-66448

vLLM vulnerable to remote code execution via transformers_utils/get_config

CVE-2025-62164

vLLM deserialization vulnerability leading to DoS and potential RCE

CVE-2025-62372

vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs

CVE-2025-62426

vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`

CVE-2025-59425

vLLM is vulnerable to timing attack at bearer auth

CVE-2025-61620

vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server

CVE-2025-6242

vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class

CVE-2025-48956

vllm API endpoints vulnerable to Denial of Service Attacks

CVE-2025-9141

vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder

CVE-2025-46570

Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching

CVE-2025-46722

vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

CVE-2025-48887

vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`

CVE-2025-48942

vLLM DOS: Remotely kill vllm over http with invalid JSON schema

CVE-2025-48943

vLLM allows clients to crash the openai server with invalid regex

CVE-2025-48944

vLLM Tool Schema allows DoS via Malformed pattern and type Fields

GHSA-j828-28rj-hfhp

vLLM vulnerable to Regular Expression Denial of Service

CVE-2025-47277

vLLM Allows Remote Code Execution via PyNcclPipe Communication Service

CVE-2025-30165

Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration

CVE-2025-30202

Data exposure via ZeroMQ on multi-node vLLM deployment

CVE-2025-32444

vLLM Vulnerable to Remote Code Execution via Mooncake Integration

CVE-2025-46560

vLLM: Quadratic Time Complexity in Input Token Processing​ leads to denial of service

GHSA-ggpf-24jw-3fcw

CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0

GHSA-hf3c-wxg2-49q9

vLLM vulnerable to Denial of Service by abusing xgrammar cache

CVE-2024-11041

vLLM Deserialization of Untrusted Data vulnerability

CVE-2024-9052

vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object

CVE-2024-9053

vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints

CVE-2025-29770

vLLM denial of service via outlines unbounded cache on disk

CVE-2025-29783

vLLM Allows Remote Code Execution via Mooncake Integration

CVE-2025-25183

vLLM uses Python 3.12 built-in hash() which leads to predictable hash collisions in prefix cache

CVE-2025-24357

vllm: Malicious model to RCE by torch.load in hf_model_weights_iterator

CVE-2024-8768

vLLM denial of service vulnerability

CVE-2024-8939

vLLM Denial of Service via the best_of parameter