Threats affecting pkg:github/vllm-project/vllm

vLLM versions prior to 0.32.0 have a permissive cross-origin resource sharing (CORS) policy that allows any origin by default. This configuration enables malicious web pages to interact with an unauthenticated vLLM server running on localhost, internal networks, or VPNs, potentially consuming GPU resources and reading responses. The issue is resolved in version 0.32.0 by restricting allowed origins.

vLLM versions prior to 0.32.0 contain an improper validation of array index vulnerability in the tokenization process. Specifically, an off-by-one error allows a pre-tokenized prompt ID equal to the vocabulary size to bypass validation, leading to a CUDA device-side assertion failure and engine termination. This issue is fixed in version 0.32.0.

vLLM versions from 0.11.1 up to but not including 0.32.0 contain a reachable assertion vulnerability (CWE-617) in the image processing path. A remote client with access to the OpenAI-compatible API can submit a specific image whose normalized pixels sum to zero, triggering a fatal assertion that crashes the inference engine, causing denial of service for all users. This issue is resolved in version 0.32.0.

CVE-2026-115911 is a vulnerability in vllm, an inference and serving engine for large language models, affecting versions from 0.19.0 up to but not including 0.32.0. Authenticated users can supply a chat template that is compiled and rendered without limits on execution time or output size, potentially causing resource exhaustion. This can block server responses or exhaust memory, leading to denial of service. The issue is fixed in version 0.32.0.

vLLM versions from 0.20.1 up to but not including 0.29.0 have an improper input validation vulnerability. This flaw allows remote attackers to crash the engine by submitting out-of-vocabulary stop_token_ids in OpenAI chat, completion, generate, or batch requests. The vulnerability can cause engine termination or memory corruption by writing outside the V2 runner's logits buffer. The issue is fixed in version 0.29.0.

vLLM versions from 0.8.5 up to but not including 0.31.0 contain a denial of service vulnerability caused by the use of an uninitialized int32 tensor in the LogprobsTensors.empty_cpu() function. This flaw allows a client sharing the engine to trigger an OverflowError during tokenizer decoding, crashing the EngineCore and disrupting all co-tenant requests. The issue is fixed in version 0.31.0.

vLLM versions from 0.18.0 up to but not including 0.31.0 have a resource exhaustion vulnerability. This flaw allows API clients to bypass the intended video/jpeg frame-count limit by manipulating the num_frames parameter via media_io_kwargs. By setting num_frames to -1 with a large inline video, the VideoMediaIO.load_base64 function decodes every frame, leading to memory exhaustion and crashing the API frontend. The vulnerability has a high severity score of 8.7 and is fixed in version 0.31.0.

vLLM versions from 0.20.0 up to but not including 0.30.0 contain a denial of service vulnerability. This flaw allows remote attackers to crash the inference engine by sending malformed multimodal metadata to the /inference/v1/generate endpoint. The attack involves replaying valid multimodal items with repeated or overlapping placeholders or mismatched metadata lists, causing a negative text span during position construction that terminates the engine. The vulnerability has a high severity with a CVSS score of 8.2 and is fixed in version 0.30.0.

vLLM versions from 0.10.2 up to but not including 0.25.0 contain a vulnerability that allows unauthenticated attackers to exhaust system memory by submitting specially crafted decompression-bomb images. This leads to out-of-memory (OOM) conditions that kill worker processes and cause denial of service to other tenants. The issue arises because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None, disabling limits on image decompression size.

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.

vLLM versions from 0.19.0 up to but not including 0.24.0 contain a decompression bomb vulnerability in the AudioMediaIO multimodal path. Authenticated attackers can exploit this by sending small compressed audio inputs that decompress into very large PCM data, leading to server memory exhaustion. This flaw is fixed in version 0.24.0.

vLLM versions from 0.22.0 up to but not including 0.24.0 contain a denial of service vulnerability. Remote attackers can exploit this by sending Generate or GenerateStream requests with output_logprobs enabled and more than 128 output_candidates.token_ids, causing a fatal sampler exception that crashes the EngineCore. This vulnerability is fixed in version 0.24.0.

CVE-2026-114053 is a critical code injection vulnerability in vllm versions from 0.7.3 up to but not including 0.31.0. It allows an attacker to execute arbitrary Python code by controlling the code revision parameter used in dynamic processor code loading when trust_remote_code is enabled. The vulnerability is exploitable via an unauthenticated /tokenize endpoint by sending a specially crafted multimodal request. This flaw is fixed in version 0.31.0.

vLLM versions from 0.25.0 up to but not including 0.31.0 contain a memory exhaustion vulnerability in the MOSS-Audio model serving component. This flaw allows unauthenticated attackers to send specially crafted requests to the /tokenize endpoint, bypassing API key restrictions, which causes unbounded caching of processor configurations and leads to host memory exhaustion and API process crashes. The issue is fixed in version 0.31.0.

vLLM versions prior to 0.31.0 contain a vulnerability where the min_tokens <= max_tokens validation is skipped if max_tokens is null in /inference/v1/generate requests. This leads to an uncaught exception that causes the EngineCore input thread to die, hanging all subsequent generation requests until the service is manually restarted. The vulnerability allows unauthenticated remote attackers to disrupt service availability by sending a single crafted request.

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.

vLLM versions before 0.31.0 have a vulnerability in the InputBatch.condense() function that causes a cross-request mask leak. This flaw allows remote attackers to influence other clients' output generation by leaving stale allowed_token_ids rows, effectively constraining victims' token outputs. The vulnerability can be exploited via concurrent constrained generate requests, including unauthenticated /invocations, leading to token allowlist reuse across batch slots.

vLLM versions before 0.29.0 improperly validate input by only checking file size when passing uploaded audio to the PyAV/FFmpeg av.open() fallback. This exposes a heap overflow vulnerability in FFmpeg's IAMF parser. Authenticated remote attackers can exploit this by uploading malformed IAMF containers to the /v1/audio/transcriptions endpoint, causing heap corruption and crashing the API process.

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust frontend can admit empty structured-output values that the Python frontend rejects, allowing ordinary constrained-generation requests to terminate the shared engine. This issue is fixed in version 0.30.0.

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can overwrite the cached query embedding so the victim's documents are scored against the attacker's query, and shared use counters can also cause a late-interaction cache-miss error. This issue is fixed in version 0.30.0.