vllm-project güvenlik açıkları (CVE)

6.5Orta

CVE-2026-115918 16 gün önce

vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs

vllm-project vllm

vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is c…

3.4Düşük

CVE-2026-115917 16 gün önce

vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

vllm-project vllm

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an…

6.5Orta

CVE-2026-115916 16 gün önce

vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

vllm-project vllm

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-pa…

8.1Yüksek

CVE-2026-115915 16 gün önce

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

vllm-project vllm

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain th…

6.5Orta

CVE-2026-115914 16 gün önce

vLLM DeepSeek-OCR image processing vulnerable to denial of service

vllm-project vllm

vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalize…

6.5Orta

CVE-2026-115913 16 gün önce

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

vllm-project vllm

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that ca…

7.5Yüksek

CVE-2026-115912 16 gün önce

vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

vllm-project vllm

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory m…

6.5Orta

CVE-2026-115911 16 gün önce

vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool

vllm-project vllm

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template tha…

6.5Orta

CVE-2026-116181 17 gün önce

vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids

vllm-project vllm

vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. Attackers can send OpenAI chat, completion, generate, or batch requests with inv…

7.7Yüksek

CVE-2026-116180 17 gün önce

vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors

vllm-project vllm

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client s…

7.5Yüksek

CVE-2026-116179 17 gün önce

vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override

vllm-project vllm

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so Vide…

5.9Orta

CVE-2026-116178 17 gün önce

vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders

vllm-project vllm

vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimoda…

7.5Yüksek

CVE-2026-116177 17 gün önce

vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

vllm-project vllm

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathologi…

8.2Yüksek

CVE-2026-116176 17 gün önce

vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

vllm-project vllm

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect…

6.5Orta

CVE-2026-116175 17 gün önce

vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions

vllm-project vllm

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio via input_audio or …

5.9Orta

CVE-2026-116174 17 gün önce

vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate

vllm-project vllm

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_i…

5.9Orta

CVE-2026-116173 17 gün önce

vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids

vllm-project vllm

vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with output_…

5.9Orta

CVE-2026-116172 17 gün önce

vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n

vllm-project vllm

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via CandidateTokens.top_n. Attackers can send Generate or GenerateStream requests with ove…

7.5Yüksek

CVE-2026-114055 21 gün önce

vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs

vllm-project vllm

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop…

6.5Orta

CVE-2026-114054 21 gün önce

vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys

vllm-project vllm

vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another requ…

8.1Yüksek

CVE-2026-114053 21 gün önce

vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision

vllm-project vllm

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enable…

7.5Yüksek

CVE-2026-114052 21 gün önce

vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs

vllm-project vllm

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send d…

7.5Yüksek

CVE-2026-114051 21 gün önce

vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate

vllm-project vllm

vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attack…

7.5Yüksek

CVE-2026-114050 21 gün önce

vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID

vllm-project vllm

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder …

3.7Düşük

CVE-2026-114049 21 gün önce

vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense

vllm-project vllm

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including v…