Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/vllm@0.32.0
purl pkg:pypi/vllm@0.32.0
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 3.9
Vulnerabilities affecting this package (1)
Advisory Summary Fixed in package version
GHSA-3cgq-c484-rx5j

Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs ## Duplicate Advisory This advisory has been withdrawn because it … There are no reported fixed by versions.
Vulnerabilities fixed by this package (11)

Advisory Summary Aliases
PYSEC-2026-4319
A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file … CVE-2026-105922
GHSA-frvg-qw88-hww9
vllm p2p never connected zmq_exhaustion ### Summary When the `OffloadingConnector` uses `TieringOffloadingSpec` with a P2P secondary tier, an API client … CVE-2026-94624
GHSA-h3rc-j82p-2c3h
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE ### Summary In vLLM 0.30.0, `ImageMediaIO` passes attacker-controlled … CVE-2026-115915
GHSA-8397-8qf6-f2gm
vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine ### … CVE-2026-115913
GHSA-gq5q-89c7-vhvx
vLLM DeepSeek-OCR image processing vulnerable to denial of service ## Summary Any vLLM deployment serving a model of the DeepSeek-OCR … CVE-2026-115914
PYSEC-2026-4347
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one … CVE-2026-115916
GHSA-q97c-p368-75c4
PYSEC-2026-4349
vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an … CVE-2026-115918
GHSA-x567-49g5-p4cf
PYSEC-2026-4348
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware … CVE-2026-115917
GHSA-vvpg-rrww-wpmh
PYSEC-2026-4345
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged … CVE-2026-115912
GHSA-6757-hggm-hp2w
PYSEC-2026-4346
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to … CVE-2026-115915
GHSA-h3rc-j82p-2c3h
PYSEC-2026-4344
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a … CVE-2026-115911
GHSA-542m-9234-8gvf