Vulnerabilities for vllm

First version without a known vulnerability: 0.26.0

Details

• GHSA-87x5-vmc3-756j2026-08-13

  vLLM: Completion prompt lists fan out into unbounded engine requests

  Fixed in: 0.26.0

• GHSA-33cg-gxv8-3p8g2026-07-20

  vLLM denial of service via prompt embeds on M-RoPE models

  Fixed in: 0.24.0

• GHSA-v82g-2437-67m22026-07-17

  vLLM: Speech-to-text upload size limit is enforced after full UploadFile read

  Fixed in: 0.24.0

• GHSA-rwxx-mrjm-wc2m2026-07-17

  vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

  Fixed in: 0.24.0

• GHSA-8wr5-jm2h-8r4f2026-07-17

  vLLM has Remote DoS via Invalid Recovered Token Reinjection

  Fixed in: 0.24.0

• GHSA-6c4r-fmh3-7rh82026-07-17

  vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models

  Fixed in: 0.18.0

• PYSEC-2026-2272026-06-22

  vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UV_INDEX_STRATEGY="unsafe-best-match" is set globally. An attacker who registers flashinfer-jit-cache on PyPI with version 0.6.11.post2 can execute arbitrary code as root during the Docker build and backdoor every resulting container image, enabling exfiltration of all user prompts, API credentials, and model data from production vLLM deployments This vulnerability is fixed in 0.22.1.

  Fixed in: 0.22.1

• GHSA-6pr9-rp53-2pmc2026-06-17

  vLLM: OOM Denial of Service via Audio Decompression Bomb

  Fixed in: 0.24.0

• GHSA-hgg8-fqqc-vfmw2026-06-17

  vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

  Fixed in: 0.24.0

• GHSA-5jv2-g5wq-cmr42026-06-17

  vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

  Fixed in: 0.24.0

• GHSA-8jr5-v98p-w75m2026-06-17

  vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

  Fixed in: 0.24.0

• GHSA-7h4p-rffg-78232026-06-17

  vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

  Fixed in: 0.24.0

• GHSA-94f4-hr76-p5j62026-06-16

  vLLM: OpenAI auth bypass

  Fixed in: 0.22.0

• GHSA-q8gq-377p-jq3r2026-06-16

  vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

  Fixed in: 0.22.0

• GHSA-wcwg-c5fc-9vrc2026-06-11

  vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method

  Fixed in: 0.19.0

• GHSA-3ww4-5jv9-j5gm2026-06-10

  vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

  Fixed in: 0.22.0

• GHSA-98f3-hwg4-4rf72026-05-26

  vllm has Improper Resource Shutdown or Release

• GHSA-83vm-p52w-f9pw2026-05-06

  vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters

  Fixed in: 0.20.0

• GHSA-hpv8-x276-m59f2026-05-05

  vLLM Vulnerable to Remote DoS via Special-Token Placeholders

  Fixed in: 0.20.0

• GHSA-x368-4g9h-fvv42026-04-27

  vLLM makes Use of Uninitialized Resource

  Fixed in: 0.19.1

• GHSA-pq5c-rjhq-qp7p2026-04-03

  vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing

  Fixed in: 0.19.0

• GHSA-pf3h-qjgv-vcpr2026-04-03

  vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `

  Fixed in: 0.19.0

• GHSA-3mwp-wvh9-75282026-04-03

  vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

  Fixed in: 0.19.0

• GHSA-7972-pg2x-xr592026-03-27

  vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out

  Fixed in: 0.18.0

• GHSA-v359-jj2v-j5362026-03-09

  vLLM has SSRF Protection Bypass

  Fixed in: 0.17.0

• GHSA-4r2x-xpjr-7cvv2026-02-02

  vLLM has RCE In Video Processing

  Fixed in: 0.14.1

• GHSA-qh4c-xf7m-gxfc2026-01-28

  vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector

  Fixed in: 0.14.1

• GHSA-2pc9-4j83-qjmr2026-01-21

  vLLM affected by RCE via auto_map dynamic module loading during model initialization

  Fixed in: 0.14.0

• GHSA-grg2-63fw-f2qr2026-01-13

  vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions

  Fixed in: 0.12.0

• GHSA-mcmc-2m55-j8jj2026-01-08

  vLLM introduced enhanced protection for CVE-2025-62164

  Fixed in: 0.13.0

• GHSA-8fr4-5q9j-m8gm2025-12-02

  vLLM vulnerable to remote code execution via transformers_utils/get_config

  Fixed in: 0.11.1

• GHSA-69j4-grxj-j64p2025-11-20

  vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`

  Fixed in: 0.11.1

• GHSA-pmqf-x6x8-p7qw2025-11-20

  vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs

  Fixed in: 0.11.1

• GHSA-mrw7-hf4f-83pf2025-11-20

  vLLM deserialization vulnerability leading to DoS and potential RCE

  Fixed in: 0.11.1

• GHSA-3f6c-7fw2-ppm42025-10-07

  vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class

  Fixed in: 0.11.0

• GHSA-6fvq-23cw-56282025-10-07

  vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server

  Fixed in: 0.11.0

• GHSA-wr9h-g72x-mwhm2025-10-07

  vLLM is vulnerable to timing attack at bearer auth

  Fixed in: 0.11.0

• GHSA-79j6-g2m3-jgfw2025-08-21

  vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder

  Fixed in: 0.10.1.1

• GHSA-rxc4-3w6r-4v472025-08-21

  vllm API endpoints vulnerable to Denial of Service Attacks

  Fixed in: 0.10.1.1

• GHSA-vrq3-r879-7m652025-05-28

  vLLM Tool Schema allows DoS via Malformed pattern and type Fields

  Fixed in: 0.9.0

• GHSA-9hcf-v7m4-6m2j2025-05-28

  vLLM allows clients to crash the openai server with invalid regex

  Fixed in: 0.9.0, 08bf7840780980c7568c573c70a6a8db94fd45ff

• GHSA-6qc9-v4r8-22xg2025-05-28

  vLLM DOS: Remotely kill vllm over http with invalid JSON schema

  Fixed in: 0.9.0, 08bf7840780980c7568c573c70a6a8db94fd45ff

• GHSA-c65p-x677-fgj62025-05-28

  vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

  Fixed in: 0.9.0, 99404f53c72965b41558aceb1bc2380875f5d848

• GHSA-4qjh-9fv9-r85r2025-05-28

  Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching

  Fixed in: 0.9.0, 77073c77bc2006eb80ea6d5128f076f5e6c6f54f

• GHSA-j828-28rj-hfhp2025-05-28

  vLLM vulnerable to Regular Expression Denial of Service

  Fixed in: 0.9.0

• GHSA-w6q7-j642-7c252025-05-28

  vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`

  Fixed in: 0.9.0, 4fc1bf813ad80172c1db31264beaef7d93fe0601

• GHSA-hjq4-87xh-g4fv2025-05-20

  vLLM Allows Remote Code Execution via PyNcclPipe Communication Service

  Fixed in: 0.8.5

• GHSA-9pcc-gvx5-r5wm2025-05-06

  Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration

  Fixed in: 0.10.0

• GHSA-vc6m-hm49-g9qg2025-04-29

  vLLM: Quadratic Time Complexity in Input Token Processing​ leads to denial of service

  Fixed in: 0.8.5

• GHSA-hj4w-hm2g-p6w52025-04-29

  vLLM Vulnerable to Remote Code Execution via Mooncake Integration

  Fixed in: 0.8.5, a5450f11c95847cf51a17207af9a3ca5ab569b2c

• GHSA-9f8f-2vmf-885j2025-04-29

  Data exposure via ZeroMQ on multi-node vLLM deployment

  Fixed in: 0.8.5

• GHSA-ggpf-24jw-3fcw2025-04-23

  CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0

  Fixed in: 0.8.0

• GHSA-hf3c-wxg2-49q92025-04-15

  vLLM vulnerable to Denial of Service by abusing xgrammar cache

  Fixed in: 0.8.4

• GHSA-cj47-qj6g-x7r42025-03-20

  vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints

• GHSA-pgr7-mhp5-fgjp2025-03-20

  vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object

• GHSA-5vqr-wprc-cpp72025-03-20

  vLLM Deserialization of Untrusted Data vulnerability

• GHSA-x3m8-f7g5-qhm72025-03-19

  vLLM Allows Remote Code Execution via Mooncake Integration

  Fixed in: 0.8.0, 288ca110f68d23909728627d3100e5a8db820aa2

• GHSA-mgrm-fgjv-mhv82025-03-19

  vLLM denial of service via outlines unbounded cache on disk

  Fixed in: 0.8.0

• GHSA-rm76-4mrf-v9r82025-02-06

  vLLM uses Python 3.12 built-in hash() which leads to predictable hash collisions in prefix cache

  Fixed in: 0.7.2, 432117cd1f59c76d97da2eaff55a7d758301dbc7

• GHSA-rh4j-5rhw-hr542025-01-27

  vllm: Malicious model to RCE by torch.load in hf_model_weights_iterator

  Fixed in: 0.7.0, d3d6bb13fb62da3234addf6574922a4ec0513d04

• GHSA-w2r7-9579-27hf2024-09-17

  vLLM denial of service vulnerability

  Fixed in: 0.5.5

• GHSA-wc36-9694-f9rf2024-09-17

  vLLM Denial of Service via the best_of parameter