vllm-project vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-115915 vLLM is an inference and serving engine for large language models.High 8.1 · Oct 26, 2026
• CVE-2026-115912 vLLM is an inference and serving engine for large language models.High 7.5 · Oct 26, 2026
• CVE-2026-116181 vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulaHigh 7.1 · Oct 25, 2026
• CVE-2026-116180 vLLM from 0.8.5 before 0.31.0 has a denial of service flaw.High 8.3 · Oct 25, 2026
• CVE-2026-116179 vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_fHigh 8.7 · Oct 25, 2026
• CVE-2026-116178 vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal meHigh 8.2 · Oct 25, 2026
• CVE-2026-116177 vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the NHigh 8.7 · Oct 25, 2026
• CVE-2026-116176 vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode aHigh 8.8 · Oct 25, 2026
• CVE-2026-116175 vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s High 7.1 · Oct 25, 2026
• CVE-2026-116174 vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked High 8.2 · Oct 25, 2026
• CVE-2026-116173 vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids liHigh 8.2 · Oct 25, 2026
• CVE-2026-116172 vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobHigh 8.2 · Oct 25, 2026
• CVE-2026-114055 vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters High 8.7 · Oct 20, 2026
• CVE-2026-114054 vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled valueHigh 7.1 · Oct 20, 2026
• CVE-2026-114053 vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients selCritical 9.2 · Oct 20, 2026
• CVE-2026-114052 vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-coHigh 8.7 · Oct 20, 2026
• CVE-2026-114051 vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dieHigh 7.1 · Oct 20, 2026
• CVE-2026-114050 vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes.High 7.1 · Oct 20, 2026
• CVE-2026-109311 vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow.High 7.1 · Oct 12, 2026
• CVE-2026-100654 vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates onHigh 7.1 · Sep 26, 2026
• CVE-2026-100653 vLLM is an inference and serving engine for large language models.High 8.3 · Sep 26, 2026
• CVE-2026-100652 vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token High 8.2 · Sep 26, 2026
• CVE-2026-100651 vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate.High 7.1 · Sep 26, 2026
• CVE-2026-100650 vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB coHigh 7.1 · Sep 26, 2026
• CVE-2026-94627 vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefilHigh 8.7 · Sep 21, 2026