Search for packages
| purl | pkg:pypi/vllm@0.16.0 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.2 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
PYSEC-2026-144
Aliases: CVE-2026-34755 GHSA-pq5c-rjhq-qp7p |
vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19.0, the VideoMediaIO.load_base64() method … |
Vulnerable |
|
GHSA-x8xr-mj9x-6h7w
|
Duplicate Advisory: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations ## Duplicate … | There are no reported fixed by versions. |
|
PYSEC-2026-226
Aliases: CVE-2026-48746 GHSA-94f4-hr76-p5j6 |
vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI … |
Vulnerable |
|
PYSEC-2026-227
Aliases: CVE-2026-54232 GHSA-jrf6-vqxq-pjv2 |
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable … |
Vulnerable |
|
GHSA-5jv2-g5wq-cmr4
Aliases: CVE-2026-53923 |
vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving ## Summary Integer truncation of tensor dimensions … |
Vulnerable |
|
GHSA-6pr9-rp53-2pmc
Aliases: CVE-2026-54233 |
vLLM: OOM Denial of Service via Audio Decompression Bomb ### Summary vLLM's `/v1/audio/transcriptions` endpoint limits compressed upload size but not … |
Vulnerable |
|
GHSA-8jr5-v98p-w75m
Aliases: CVE-2026-12491 |
vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations ## Summary Issue … |
Vulnerable |
|
GHSA-hgg8-fqqc-vfmw
Aliases: CVE-2026-54236 |
vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router # vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses … |
Vulnerable |
|
PYSEC-2026-2304
Aliases: CVE-2026-55574 GHSA-rwxx-mrjm-wc2m |
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes … |
Vulnerable |
|
PYSEC-2026-2301
Aliases: CVE-2026-47155 GHSA-3ww4-5jv9-j5gm |
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM's revision pinning controls do … |
Vulnerable |
|
PYSEC-2026-2303
Aliases: CVE-2026-55514 GHSA-33cg-gxv8-3p8g |
vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload … |
Vulnerable |
|
PYSEC-2026-2306
Aliases: CVE-2026-7141 GHSA-x368-4g9h-fvv4 |
A vulnerability was found in vllm up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py … |
Vulnerable |
|
PYSEC-2026-2297
Aliases: CVE-2026-27893 GHSA-7972-pg2x-xr59 |
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version … |
Vulnerable |
|
PYSEC-2026-2299
Aliases: CVE-2026-34760 GHSA-6c4r-fmh3-7rh8 |
vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa … |
Vulnerable |
|
PYSEC-2026-3410
Aliases: CVE-2026-34753 GHSA-pf3h-qjgv-vcpr |
vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url ` ### Summary A Server Side Request Forgery (SSRF) vulnerability in `download_bytes_from_url` allows … |
Vulnerable |
|
PYSEC-2026-3405
Aliases: CVE-2026-54235 GHSA-7h4p-rffg-7823 |
vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels ## Summary All temperature validation gates use comparison operators … | There are no reported fixed by versions. |
|
PYSEC-2026-3403
Aliases: CVE-2026-53923 GHSA-5jv2-g5wq-cmr4 |
vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving ## Summary Integer truncation of tensor dimensions … | There are no reported fixed by versions. |
|
PYSEC-2026-2298
Aliases: CVE-2026-34756 GHSA-3mwp-wvh9-7528 |
vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.19.0, a Denial of … |
Vulnerable |
|
PYSEC-2026-3407
Aliases: CVE-2026-9540 GHSA-98f3-hwg4-4rf7 |
vllm has Improper Resource Shutdown or Release A vulnerability was identified in vllm-project vllm 0.19.0. This issue affects some unknown … | There are no reported fixed by versions. |
|
PYSEC-2026-3406
Aliases: CVE-2026-12491 GHSA-8jr5-v98p-w75m |
vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations ## Summary Issue … | There are no reported fixed by versions. |
|
PYSEC-2026-2300
Aliases: CVE-2026-41523 GHSA-q8gq-377p-jq3r |
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in … |
Vulnerable |
|
PYSEC-2026-3411
Aliases: CVE-2026-25960 GHSA-v359-jj2v-j536 |
vLLM has SSRF Protection Bypass ## Summary The SSRF protection fix for https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc can be bypassed in the `load_from_url_async` method … |
Vulnerable |
|
PYSEC-2026-3409
Aliases: CVE-2026-44222 GHSA-hpv8-x276-m59f |
vLLM Vulnerable to Remote DoS via Special-Token Placeholders ## Summary This report explains a Token Injection vulnerability in vLLM’s multimodal … |
Vulnerable |
|
PYSEC-2026-3404
Aliases: CVE-2026-54233 GHSA-6pr9-rp53-2pmc |
vLLM: OOM Denial of Service via Audio Decompression Bomb ### Summary vLLM's `/v1/audio/transcriptions` endpoint limits compressed upload size but not … | There are no reported fixed by versions. |
|
PYSEC-2026-3408
Aliases: CVE-2026-54236 GHSA-hgg8-fqqc-vfmw |
vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router # vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses … | There are no reported fixed by versions. |
|
PYSEC-2026-2302
Aliases: CVE-2026-5497 GHSA-wcwg-c5fc-9vrc |
vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame … |
Vulnerable Vulnerable |
|
PYSEC-2026-3937
Aliases: CVE-2026-73555 GHSA-hwrm-c4cx-rf4j |
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages ## Summary When the vLLM API receives a malformed … |
Vulnerable |
|
PYSEC-2026-3936
Aliases: CVE-2026-71486 GHSA-8737-qx52-hjff |
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds ## Summary The `/v1/completions/derender` and `/v1/chat/completions/derender` endpoints accept caller-supplied … |
Vulnerable |
|
PYSEC-2026-3933
Aliases: CVE-2026-73556 GHSA-48jh-3gj7-fg8v |
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m ### Summary The fix … |
Vulnerable |
|
PYSEC-2026-3935
Aliases: CVE-2026-73558 GHSA-7m6h-x95x-82q5 |
vLLM: Cross-User Data Leak Vulnerability ### Summary An integer overflow in the act_and_mul_kernel kernel can cause the output of one … |
Vulnerable |
|
PYSEC-2026-3934
Aliases: CVE-2026-73560 GHSA-4hhp-h66f-j5j7 |
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections ### Summary `vllm/transformers_utils/processors/mimo_v2_omni.py` — … |
Vulnerable |
|
PYSEC-2026-3985
Aliases: CVE-2026-90553 GHSA-3c86-2m5g-59q7 |
vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when … |
Vulnerable |
|
PYSEC-2026-4008
Aliases: CVE-2026-94626 |
vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded … |
Vulnerable |
|
PYSEC-2026-4003
Aliases: CVE-2026-78684 GHSA-cqm8-jxg6-fqfq |
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. … |
Vulnerable |
|
PYSEC-2026-4006
Aliases: CVE-2026-94624 GHSA-frvg-qw88-hww9 |
vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and … |
Vulnerable |
|
PYSEC-2026-4004
Aliases: CVE-2026-94622 |
vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. … |
Vulnerable |
|
PYSEC-2026-3999
Aliases: CVE-2026-93841 |
vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence … |
Vulnerable |
|
PYSEC-2026-3998
Aliases: CVE-2026-93840 |
vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token … |
Vulnerable |
|
PYSEC-2026-4005
Aliases: CVE-2026-94623 |
vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly … |
Vulnerable |
|
PYSEC-2026-4178
Aliases: CVE-2026-69147 GHSA-8pw2-6jv3-mj5j |
vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation ## Summary Current vLLM `main` lets an inference request choose the … |
Vulnerable |
|
PYSEC-2026-3996
Aliases: CVE-2026-93436 |
vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers … |
Vulnerable |
|
PYSEC-2026-4007
Aliases: CVE-2026-94625 |
vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are … |
Vulnerable |
|
PYSEC-2026-4000
Aliases: CVE-2026-93989 |
vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can … |
Vulnerable |
|
PYSEC-2026-3997
Aliases: CVE-2026-93592 GHSA-25q3-v2hm-8vpf |
vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing … |
Vulnerable |
|
PYSEC-2026-4179
Aliases: CVE-2026-57173 GHSA-hcwq-8wjf-3gcr |
vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions ### Summary The audio decode-duration guard (`max_duration_s`, env `VLLM_MAX_AUDIO_DECODE_DURATION_S`, default 600s) that protects … |
Vulnerable |
|
GHSA-7h4p-rffg-7823
Aliases: CVE-2026-54235 |
vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels ## Summary All temperature validation gates use comparison operators … |
Vulnerable Vulnerable |
|
PYSEC-2026-4198
Aliases: CVE-2026-105755 GHSA-2phq-3phc-84px |
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score … |
Vulnerable |
|
PYSEC-2026-4186
Aliases: CVE-2026-103241 |
A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs … |
Vulnerable |
|
PYSEC-2026-4197
Aliases: CVE-2026-105753 GHSA-ph3r-5jfg-f84f |
vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache … |
Vulnerable |
|
PYSEC-2026-4199
Aliases: CVE-2026-105757 GHSA-85xf-c7hm-whqw |
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped … |
Vulnerable |
|
PYSEC-2026-4184
Aliases: CVE-2026-100650 GHSA-p6g9-7v3x-m8mv |
vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio … |
Vulnerable |
|
PYSEC-2026-4308
Aliases: CVE-2026-105752 GHSA-935w-9g4m-p28p |
vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle ## Affected - **Ecosystem / package:** pip … |
Vulnerable |
|
PYSEC-2026-4306
Aliases: CVE-2026-105756 GHSA-2823-qmq8-rwvj |
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service … |
Vulnerable |
|
PYSEC-2026-4319
Aliases: CVE-2026-105922 |
A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file … |
Vulnerable |
|
PYSEC-2026-4309
Aliases: CVE-2026-105754 GHSA-ph72-cqr5-qpp7 |
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features ## Affected - **Ecosystem / package:** pip / `vllm` - **Affected versions:** … |
Vulnerable |
|
PYSEC-2026-4325
Aliases: CVE-2026-105759 GHSA-5fj9-pfhr-6j48 |
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records … |
Vulnerable |
|
GHSA-p92p-rxj5-7p2x
Aliases: CVE-2026-114050 |
vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine ## Summary Multimodal … |
Vulnerable |
|
GHSA-3cgq-c484-rx5j
|
Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-gx7p-2j49-hfq4
Aliases: CVE-2026-114055 |
vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.) ## Summary API clients can supply … |
Vulnerable |
|
GHSA-frvg-qw88-hww9
Aliases: CVE-2026-94624 |
vllm p2p never connected zmq_exhaustion ### Summary When the `OffloadingConnector` uses `TieringOffloadingSpec` with a P2P secondary tier, an API client … |
Vulnerable |
|
GHSA-h3rc-6mm3-gc2m
Aliases: CVE-2026-114053 |
vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution ## Summary An untrusted multimodal request can set `mm_processor_kwargs.code_revision`. When vLLM serves a … |
Vulnerable |
|
GHSA-f623-hjm8-5wg5
|
Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution ## Duplicate Advisory This advisory has been withdrawn because it is … |
Vulnerable |
|
GHSA-8qpc-6rxx-4pxf
|
Duplicate Advisory: vllm p2p never connected zmq_exhaustion ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate … |
Vulnerable |
|
GHSA-h3rc-j82p-2c3h
Aliases: CVE-2026-115915 |
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE ### Summary In vLLM 0.30.0, `ImageMediaIO` passes attacker-controlled … |
Vulnerable |
|
GHSA-8397-8qf6-f2gm
Aliases: CVE-2026-115913 |
vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine ### … |
Vulnerable |
|
GHSA-gq5q-89c7-vhvx
Aliases: CVE-2026-115914 |
vLLM DeepSeek-OCR image processing vulnerable to denial of service ## Summary Any vLLM deployment serving a model of the DeepSeek-OCR … |
Vulnerable |
|
PYSEC-2026-4352
Aliases: CVE-2026-116177 GHSA-mm38-5g96-7j6x |
vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the … |
Vulnerable |
|
PYSEC-2026-4347
Aliases: CVE-2026-115916 GHSA-q97c-p368-75c4 |
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one … |
Vulnerable |
|
PYSEC-2026-4349
Aliases: CVE-2026-115918 GHSA-x567-49g5-p4cf |
vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an … |
Vulnerable |
|
PYSEC-2026-4348
Aliases: CVE-2026-115917 GHSA-vvpg-rrww-wpmh |
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware … |
Vulnerable |
|
PYSEC-2026-4345
Aliases: CVE-2026-115912 GHSA-6757-hggm-hp2w |
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged … |
Vulnerable |
|
PYSEC-2026-4351
Aliases: CVE-2026-116176 GHSA-vfp2-c8pq-v6h6 |
vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by … |
Vulnerable |
|
PYSEC-2026-4362
Aliases: CVE-2026-114054 GHSA-rh6f-3x46-j33q |
vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled … |
Vulnerable |