Threats affecting pkg:pypi/vllm

vLLM versions from 0.20.1 up to but not including 0.29.0 have an improper input validation vulnerability. This flaw allows remote attackers to crash the engine by submitting out-of-vocabulary stop_token_ids in OpenAI chat, completion, generate, or batch requests. The vulnerability can cause engine termination or memory corruption by writing outside the V2 runner's logits buffer. The issue is fixed in version 0.29.0.

vLLM versions from 0.8.5 up to but not including 0.31.0 contain a denial of service vulnerability caused by the use of an uninitialized int32 tensor in the LogprobsTensors.empty_cpu() function. This flaw allows a client sharing the engine to trigger an OverflowError during tokenizer decoding, crashing the EngineCore and disrupting all co-tenant requests. The issue is fixed in version 0.31.0.

vLLM versions from 0.18.0 up to but not including 0.31.0 have a resource exhaustion vulnerability. This flaw allows API clients to bypass the intended video/jpeg frame-count limit by manipulating the num_frames parameter via media_io_kwargs. By setting num_frames to -1 with a large inline video, the VideoMediaIO.load_base64 function decodes every frame, leading to memory exhaustion and crashing the API frontend. The vulnerability has a high severity score of 8.7 and is fixed in version 0.31.0.

vLLM versions from 0.20.0 up to but not including 0.30.0 contain a denial of service vulnerability. This flaw allows remote attackers to crash the inference engine by sending malformed multimodal metadata to the /inference/v1/generate endpoint. The attack involves replaying valid multimodal items with repeated or overlapping placeholders or mismatched metadata lists, causing a negative text span during position construction that terminates the engine. The vulnerability has a high severity with a CVSS score of 8.2 and is fixed in version 0.30.0.

vLLM versions from 0.10.2 up to but not including 0.25.0 contain a vulnerability that allows unauthenticated attackers to exhaust system memory by submitting specially crafted decompression-bomb images. This leads to out-of-memory (OOM) conditions that kill worker processes and cause denial of service to other tenants. The issue arises because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None, disabling limits on image decompression size.

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.

vLLM versions from 0.19.0 up to but not including 0.24.0 contain a decompression bomb vulnerability in the AudioMediaIO multimodal path. Authenticated attackers can exploit this by sending small compressed audio inputs that decompress into very large PCM data, leading to server memory exhaustion. This flaw is fixed in version 0.24.0.

vLLM versions from 0.22.0 up to but not including 0.24.0 have an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream services. This flaw allows attackers to submit requests with out-of-vocabulary prompt token IDs, causing a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy. The issue is fixed in version 0.24.0.

vLLM versions from 0.22.0 up to but not including 0.24.0 contain a denial of service vulnerability. Remote attackers can exploit this by sending Generate or GenerateStream requests with output_logprobs enabled and more than 128 output_candidates.token_ids, causing a fatal sampler exception that crashes the EngineCore. This vulnerability is fixed in version 0.24.0.

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via CandidateTokens.top_n. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping top_n values to trigger torch.topk failures that terminate EngineCore.

vLLM versions from 0.7.3 up to but not including 0.31.0 contain an uncontrolled resource consumption vulnerability. Remote clients can manipulate multimodal processor parameters via mm_processor_kwargs to set large values for image size, patch count, crop count, or frame count. This can exhaust server memory and cause termination of the shared server process. The vulnerability is fixed in version 0.31.0.

vLLM versions prior to 0.31.0 have an improper access control vulnerability involving cache aliasing. Authenticated attackers can manipulate cache keys by supplying controlled values like EXIF ImageID or cache_salt, enabling them to access cached processed media or reuse key-value state from other requests. This vulnerability is fixed in version 0.31.0.

CVE-2026-114053 is a critical code injection vulnerability in vllm versions from 0.7.3 up to but not including 0.31.0. It allows an attacker to execute arbitrary Python code by controlling the code revision parameter used in dynamic processor code loading when trust_remote_code is enabled. The vulnerability is exploitable via an unauthenticated /tokenize endpoint by sending a specially crafted multimodal request. This flaw is fixed in version 0.31.0.

vLLM versions from 0.25.0 up to but not including 0.31.0 contain a memory exhaustion vulnerability in the MOSS-Audio model serving component. This flaw allows unauthenticated attackers to send specially crafted requests to the /tokenize endpoint, bypassing API key restrictions, which causes unbounded caching of processor configurations and leads to host memory exhaustion and API process crashes. The issue is fixed in version 0.31.0.