Search for packages
| purl | pkg:pypi/vllm@0.10.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-m432-9c3w-4qan
Aliases: CVE-2025-62164 GHSA-mrw7-hf4f-83pf |
vLLM deserialization vulnerability leading to DoS and potential RCE A memory corruption vulnerability that leading to a crash (denial-of-service) and potentially remote code execution (RCE) exists in vLLM versions 0.10.2 and later, in the Completions API endpoint. When processing user-supplied prompt embeddings, the endpoint loads serialized tensors using torch.load() without sufficient validation. Due to a change introduced in PyTorch 2.8.0, sparse tensor integrity checks are disabled by default. As a result, maliciously crafted tensors can bypass internal bounds checks and trigger an out-of-bounds memory write during the call to to_dense(). This memory corruption can crash vLLM and potentially lead to code execution on the server hosting vLLM. |
Affected by 2 other vulnerabilities. |
|
VCID-nctw-rz8h-f3af
Aliases: CVE-2026-22773 GHSA-grg2-63fw-f2qr PYSEC-2026-143 |
vLLM is an inference and serving engine for large language models (LLMs). In versions from 0.6.4 to before 0.12.0, users can crash the vLLM engine serving multimodal models that use the Idefics3 vision model implementation by sending a specially crafted 1x1 pixel image. This causes a tensor dimension mismatch that results in an unhandled runtime error, leading to complete server termination. This issue has been patched in version 0.12.0. |
Affected by 1 other vulnerability. |
|
VCID-z6u4-yvcm-gqhm
Aliases: GHSA-mcmc-2m55-j8jj |
vLLM introduced enhanced protection for CVE-2025-62164 The fix [here](https://github.com/vllm-project/vllm/pull/27204) for CVE-2025-62164 is not sufficient. The fix only disables prompt embeds by default rather than addressing the root cause, so the DoS vulnerability remains when the feature is enabled. |
Affected by 1 other vulnerability. |
|
VCID-za3a-c9m1-jqgz
Aliases: CVE-2026-34755 GHSA-pq5c-rjhq-qp7p PYSEC-2026-144 |
vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19.0, the VideoMediaIO.load_base64() method at vllm/multimodal/media/video.py splits video/jpeg data URLs by comma to extract individual JPEG frames, but does not enforce a frame count limit. The num_frames parameter (default: 32), which is enforced by the load_bytes() code path, is completely bypassed in the video/jpeg base64 path. An attacker can send a single API request containing thousands of comma-separated base64-encoded JPEG frames, causing the server to decode all frames into memory and crash with OOM. This vulnerability is fixed in 0.19.0. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-02T04:49:25.400393+00:00 | GitLab Importer | Affected by | VCID-z6u4-yvcm-gqhm | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/vllm/GHSA-mcmc-2m55-j8jj.yml | 38.6.0 |
| 2026-06-02T04:48:31.756638+00:00 | GitLab Importer | Affected by | VCID-m432-9c3w-4qan | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/vllm/CVE-2025-62164.yml | 38.6.0 |
| 2026-06-02T04:24:27.972320+00:00 | Pypa Importer | Affected by | VCID-za3a-c9m1-jqgz | https://github.com/pypa/advisory-database/blob/main/vulns/vllm/PYSEC-2026-144.yaml | 38.6.0 |
| 2026-06-02T04:23:39.342423+00:00 | Pypa Importer | Affected by | VCID-nctw-rz8h-f3af | https://github.com/pypa/advisory-database/blob/main/vulns/vllm/PYSEC-2026-143.yaml | 38.6.0 |