Threat Intelligence Database

vLLM versions prior to 0.23.1rc0 have an incomplete fix for a sensitive information leak vulnerability (CVE-2026-54236). Certain API routes and WebSocket handlers in vLLM bypass the global exception sanitization, causing memory addresses to be exposed in error messages sent to clients. An unauthenticated attacker can exploit this by sending malformed image data to trigger errors that leak heap memory addresses in JSON responses. This vulnerability is fixed in version 0.23.1rc0.

vLLM versions prior to 0.23.1rc0 have a vulnerability in the /v1/audio/transcriptions endpoint where the compressed upload size is limited but the decoded PCM output size is not. This allows a relatively small OPUS audio file to expand massively in memory during decoding, causing data amplification. The issue is fixed in version 0.23.1rc0.

vLLM versions from 0.5.5 up to but not including 0.23.1rc0 contain a vulnerability where integer truncation in the GGUF dequantize CUDA kernels causes partial tensor processing. This results in uninitialized portions of output tensors retaining residual GPU memory data, potentially exposing data from other users in multi-tenant inference environments. The issue is fixed starting with version 0.23.1rc0.

vLLM versions prior to 0.22.0 have an insufficient verification of data authenticity issue related to revision pinning controls. These controls do not consistently apply to all artifacts loaded for a model, allowing dynamic code and other components to be loaded from unpinned or default revisions. This creates a supply-chain integrity risk where operators may unknowingly serve unreviewed or unintended model artifacts. The vulnerability is fixed in version 0.22.0.

vllm-project/vllm version 0.14.1 contains a high-severity path traversal vulnerability (CWE-22) due to hardcoded trust_remote_code=True parameters in two model implementation files. This bypasses user settings intended to disable remote code execution, allowing malicious HuggingFace model repositories to execute code remotely. The issue is a partial fix failure for previous CVEs and specifically affects deployments using NemotronVL or KimiK25 models. No official patch or remediation guidance is currently available.