CVE-2026-100654 | Medium | 6.5 | 2026-09-26 | vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates o… |
CVE-2026-100653 | Medium | 6.5 | 2026-09-26 | vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision… |
CVE-2026-100652 | Medium | 5.9 | 2026-09-26 | vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token… |
CVE-2026-100651 | Medium | 6.5 | 2026-09-26 | vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a… |
CVE-2026-100650 | Medium | 6.5 | 2026-09-26 | vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB c… |
CVE-2026-100649 | Low | 3.7 | 2026-09-26 | vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent coun… |
CVE-2026-100648 | Medium | 5.3 | 2026-09-26 | vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file si… |
CVE-2026-100647 | Medium | 5.3 | 2026-09-26 | vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, wh… |
CVE-2026-94627 | High | 7.5 | 2026-09-21 | vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefi… |
CVE-2026-94626 | High | 7.5 | 2026-09-21 | vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unb… |
CVE-2026-94625 | Medium | 5.3 | 2026-09-21 | vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders th… |
CVE-2026-94624 | High | 7.5 | 2026-09-21 | vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a pee… |
CVE-2026-94623 | High | 7.5 | 2026-09-21 | vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block coun… |
CVE-2026-94622 | High | 7.5 | 2026-09-21 | vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments… |
CVE-2026-93989 | Low | 3.1 | 2026-09-19 | vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). A… |
CVE-2026-93841 | Low | 3.7 | 2026-09-18 | vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset w… |
CVE-2026-93840 | Low | 3.7 | 2026-09-18 | vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). A… |
CVE-2026-93592 | High | 7.5 | 2026-09-18 | vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to c… |
CVE-2026-93436 | High | 7.5 | 2026-09-17 | vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attacke… |
CVE-2026-69147 | Medium | 6.5 | 2026-09-16 | vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.v… |
CVE-2026-57173 | Medium | 6.5 | 2026-09-16 | vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v1/chat/completions calls AudioMediaIO.l… |
CVE-2026-92365 | Medium | 4.3 | 2026-09-16 | A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinking_budget_st… |
CVE-2026-92220 | Medium | 5.3 | 2026-09-16 | A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_finished/MoRIIOConnectorWorker.get_fini… |
CVE-2026-90878 | Medium | 4.3 | 2026-09-15 | A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template… |
CVE-2026-90713 | Low | 3.3 | 2026-09-14 | A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/sr… |
CVE-2026-90555 | Medium | 6.5 | 2026-09-12 | vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks… |
CVE-2026-90554 | Medium | 6.2 | 2026-09-12 | vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In na… |
CVE-2026-90553 | High | 7.8 | 2026-09-12 | vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loa… |
CVE-2026-78684 | Medium | 5.3 | 2026-08-25 | vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can a… |
CVE-2026-73560 | Medium | 6.5 | 2026-08-17 | vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mim… |
CVE-2026-71486 | Medium | 4.3 | 2026-08-17 | vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints ac… |
CVE-2026-73559 | Medium | 6.5 | 2026-08-13 | vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypo… |
CVE-2026-73558 | Medium | 5.3 | 2026-08-13 | vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can caus… |
CVE-2026-73557 | | | 2026-08-13 | vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses t… |
CVE-2026-73556 | Medium | 5.3 | 2026-08-13 | vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend… |
CVE-2026-73555 | Medium | 5.3 | 2026-08-13 | vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py… |
CVE-2026-55574 | High | 7.5 | 2026-07-06 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user… |
CVE-2026-55514 | Medium | 6.5 | 2026-07-06 | vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a /v1/completions request with a model u… |
CVE-2026-54234 | High | 7.5 | 2026-07-06 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding work… |
CVE-2026-55646 | Medium | 6.5 | 2026-07-06 | vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/translations routes call r… |
CVE-2026-54236 | Medium | 5.3 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message h… |
CVE-2026-54235 | Medium | 6.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (<, >)… |
CVE-2026-54233 | Medium | 6.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, vLLM's /v1/audio/transcriptions endpoint limits compressed upload… |
CVE-2026-54232 | High | 8.8 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack t… |
CVE-2026-53923 | High | 7.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0, integer truncation of tensor dimensions in vLLM's GGUF de… |
CVE-2026-48746 | Critical | 9.1 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on… |
CVE-2026-47155 | Medium | 6.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM's revision pinning controls do not consistently apply to all ar… |
CVE-2026-41523 | High | 7.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading… |
CVE-2026-12491 | Medium | 4.8 | 2026-06-17 | A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specif… |
CVE-2026-5497 | High | 7.5 | 2026-06-11 | vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMedi… |
CVE-2026-4944 | High | 8.8 | 2026-05-28 | vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model implementation files (`vllm/mo… |
CVE-2026-9540 | Medium | 5.3 | 2026-05-26 | A vulnerability was identified in vllm-project vllm 0.19.0. This issue affects some unknown processing of the component OpenAI-compatible Serving Path. Such ma… |
CVE-2026-44223 | Medium | 6.5 | 2026-05-12 | vLLM is an inference and serving engine for large language models (LLMs). From 0.18.0 to before 0.20.0, the extract_hidden_states speculative decoding proposer… |
CVE-2026-44222 | Medium | 6.5 | 2026-05-12 | vLLM is an inference and serving engine for large language models (LLMs). From 0.6.1 to before 0.20.0, there is a a Token Injection vulnerability in vLLM’s mul… |
CVE-2026-34756 | Medium | 6.5 | 2026-04-06 | vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM Ope… |
CVE-2026-34755 | Medium | 6.5 | 2026-04-06 | vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19.0, the VideoMediaIO.load_base64() method at vllm/multimodal… |
CVE-2026-34753 | Medium | 5.4 | 2026-04-06 | vLLM is an inference and serving engine for large language models (LLMs). From 0.16.0 to before 0.19.0, a server-side request forgery (SSRF) vulnerability in d… |
CVE-2026-34760 | Medium | 5.9 | 2026-04-02 | vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa defaults to using numpy.mean for… |
CVE-2026-27893 | High | 8.8 | 2026-03-27 | vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation file… |
CVE-2026-25960 | High | 7.1 | 2026-03-09 | vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_… |
CVE-2026-22778 | Critical | 9.8 | 2026-02-02 | vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpo… |
CVE-2026-24779 | High | 7.1 | 2026-01-27 | vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.14.1, a Server-Side Request Forgery (SSRF) vulnerability exists in… |
CVE-2026-22807 | High | 8.8 | 2026-01-21 | vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto… |
CVE-2026-22773 | Medium | 6.5 | 2026-01-10 | vLLM is an inference and serving engine for large language models (LLMs). In versions from 0.6.4 to before 0.12.0, users can crash the vLLM engine serving mult… |
CVE-2025-66448 | High | 7.1 | 2025-12-01 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.11.1, vllm has a critical remote code execution vector in a config class n… |
CVE-2025-62426 | Medium | 6.5 | 2025-11-21 | vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the /v1/chat/completions and /tokenize endpoints… |
CVE-2025-62372 | Medium | 6.5 | 2025-11-21 | vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, users can crash the vLLM engine serving multimod… |
CVE-2025-62164 | High | 8.8 | 2025-11-21 | vLLM is an inference and serving engine for large language models (LLMs). From versions 0.10.2 to before 0.11.1, a memory corruption vulnerability could lead t… |
CVE-2025-59425 | High | 7.5 | 2025-10-07 | vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support in vLLM performs validation using a met… |
CVE-2025-48956 | High | 7.5 | 2025-08-21 | vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.10.1.1, a Denial of Service (DoS) vulnerability can be trigger… |
CVE-2025-48944 | Medium | 6.5 | 2025-05-30 | vLLM is an inference and serving engine for large language models (LLMs). In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used with the /v1/chat/c… |
CVE-2025-48943 | Medium | 6.5 | 2025-05-30 | vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes… |
CVE-2025-48942 | Medium | 6.5 | 2025-05-30 | vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a… |
CVE-2025-48887 | Medium | 6.5 | 2025-05-30 | vLLM, an inference and serving engine for large language models (LLMs), has a Regular Expression Denial of Service (ReDoS) vulnerability in the file `vllm/entr… |
CVE-2025-46722 | Medium | 4.2 | 2025-05-29 | vLLM is an inference and serving engine for large language models (LLMs). In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.p… |
CVE-2025-46570 | Low | 2.6 | 2025-05-29 | vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanis… |
CVE-2025-47277 | Critical | 9.8 | 2025-05-20 | vLLM, an inference and serving engine for large language models (LLMs), has an issue in versions 0.6.5 through 0.8.4 that ONLY impacts environments using the `… |
CVE-2025-30165 | High | 8.0 | 2025-05-06 | vLLM is an inference and serving engine for large language models. In a multi-node vLLM deployment using the V0 engine, vLLM uses ZeroMQ for some multi-node co… |
CVE-2025-46560 | Medium | 6.5 | 2025-04-30 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.8.0 and prior to 0.8.5 are affected by a critica… |
CVE-2025-32444 | Critical | 10.0 | 2025-04-30 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration… |
CVE-2025-30202 | High | 7.5 | 2025-04-30 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vulnerable to denial… |
CVE-2024-9053 | Critical | 9.8 | 2025-03-20 | vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls t… |
CVE-2024-11041 | Critical | 9.8 | 2025-03-20 | vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse received sockets… |
CVE-2025-29783 | Critical | 9.0 | 2025-03-19 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed d… |
CVE-2025-29770 | Medium | 6.5 | 2025-03-19 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. The outlines library is one of the backends used by vLLM to support struc… |
CVE-2025-25183 | Low | 2.6 | 2025-02-07 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Maliciously constructed statements can lead to hash collisions, resulting… |
CVE-2025-24357 | High | 7.5 | 2025-01-27 | vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which i… |