VulnerableCode Package Details - pkg:pypi/vllm@0.6.4.post1

Vulnerabilities affecting this package (78)

Advisory	Summary	Fixed in package version
GHSA-ggpf-24jw-3fcw	CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0 ## Description https://github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54 reported a vulnerability where loading …	0.8.0 Vulnerable
GHSA-j828-28rj-hfhp	vLLM vulnerable to Regular Expression Denial of Service ### Summary A recent review identified several regular expressions in the vllm …	0.9.0 Vulnerable
PYSEC-2025-42 Aliases: CVE-2025-32444 GHSA-hj4w-hm2g-p6w5	vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, …	0.8.5 Vulnerable
PYSEC-2025-50 Aliases: CVE-2025-48887 GHSA-w6q7-j642-7c25	vLLM, an inference and serving engine for large language models (LLMs), has a Regular Expression Denial of Service (ReDoS) vulnerability …	0.9.0 Vulnerable
PYSEC-2025-58 Aliases: CVE-2025-24357 GHSA-rh4j-5rhw-hr54	vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which is downloaded …	0.7.0 Vulnerable
PYSEC-2025-50 Aliases: CVE-2025-48887 GHSA-w6q7-j642-7c25	vLLM, an inference and serving engine for large language models (LLMs), has a Regular Expression Denial of Service (ReDoS) vulnerability …	0.9.0 Vulnerable
PYSEC-2025-223 Aliases: CVE-2025-29770 GHSA-mgrm-fgjv-mhv8	vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. The outlines library is one of the backends …	0.8.0 Vulnerable
PYSEC-2025-53 Aliases: CVE-2025-46570 GHSA-4qjh-9fv9-r85r	vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt …	0.9.0 Vulnerable
PYSEC-2025-62 Aliases: CVE-2025-25183 GHSA-rm76-4mrf-v9r8	vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Maliciously constructed statements can lead to hash collisions, …	0.7.2 Vulnerable
PYSEC-2026-143 Aliases: CVE-2026-22773 GHSA-grg2-63fw-f2qr	vLLM is an inference and serving engine for large language models (LLMs). In versions from 0.6.4 to before 0.12.0, users …	0.12.0 Vulnerable
PYSEC-2025-43 Aliases: CVE-2025-46722 GHSA-c65p-x677-fgj6	vLLM is an inference and serving engine for large language models (LLMs). In versions starting from 0.7.0 to before 0.9.0, …	0.9.0 Vulnerable
PYSEC-2026-226 Aliases: CVE-2026-48746 GHSA-94f4-hr76-p5j6	vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI …	0.22.0 Vulnerable
PYSEC-2026-227 Aliases: CVE-2026-54232 GHSA-jrf6-vqxq-pjv2	vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable …	0.22.1 Vulnerable
PYSEC-2026-568 Aliases: CVE-2024-9052 GHSA-pgr7-mhp5-fgjp	vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recv_object() …	There are no reported fixed by versions.
GHSA-5jv2-g5wq-cmr4 Aliases: CVE-2026-53923	vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving ## Summary Integer truncation of tensor dimensions …	0.24.0 Vulnerable
GHSA-6pr9-rp53-2pmc Aliases: CVE-2026-54233	vLLM: OOM Denial of Service via Audio Decompression Bomb ### Summary vLLM's `/v1/audio/transcriptions` endpoint limits compressed upload size but not …	0.24.0 Vulnerable
GHSA-hgg8-fqqc-vfmw Aliases: CVE-2026-54236	vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router # vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses …	0.24.0 Vulnerable
PYSEC-2026-2304 Aliases: CVE-2026-55574 GHSA-rwxx-mrjm-wc2m	vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes …	0.24.0 Vulnerable
PYSEC-2026-2017 Aliases: CVE-2025-30165 GHSA-9pcc-gvx5-r5wm	Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration ### Affected Environments Note that this issue only affects the V0 …	0.10.0 Vulnerable
PYSEC-2026-2301 Aliases: CVE-2026-47155 GHSA-3ww4-5jv9-j5gm	vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM's revision pinning controls do …	0.22.0 Vulnerable
PYSEC-2026-2013 Aliases: CVE-2025-61620 GHSA-6fvq-23cw-5628	vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server ### Summary A resource-exhaustion (denial-of-service) vulnerability exists in multiple endpoints …	0.11.0 Vulnerable
PYSEC-2026-2306 Aliases: CVE-2026-7141 GHSA-x368-4g9h-fvv4	A vulnerability was found in vllm up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py …	0.19.1 Vulnerable
PYSEC-2026-2019 Aliases: CVE-2025-62372 GHSA-pmqf-x6x8-p7qw	vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs ### Summary Users can crash the vLLM engine serving …	0.11.1 Vulnerable
PYSEC-2026-2299 Aliases: CVE-2026-34760 GHSA-6c4r-fmh3-7rh8	vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa …	0.18.0 Vulnerable
PYSEC-2026-2026 Aliases: CVE-2025-59425 GHSA-wr9h-g72x-mwhm	vLLM is vulnerable to timing attack at bearer auth ### Summary The API key support in vLLM performed validation using …	0.11.0 Vulnerable
PYSEC-2026-2016 Aliases: CVE-2025-30202 GHSA-9f8f-2vmf-885j	Data exposure via ZeroMQ on multi-node vLLM deployment ### Impact In a multi-node vLLM deployment, vLLM uses ZeroMQ for some …	0.8.5 Vulnerable
PYSEC-2026-3405 Aliases: CVE-2026-54235 GHSA-7h4p-rffg-7823	vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels ## Summary All temperature validation gates use comparison operators …	There are no reported fixed by versions.
PYSEC-2026-2012 Aliases: CVE-2025-62426 GHSA-69j4-grxj-j64p	vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs` ### Summary The /v1/chat/completions and …	0.11.1 Vulnerable
PYSEC-2026-3403 Aliases: CVE-2026-53923 GHSA-5jv2-g5wq-cmr4	vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving ## Summary Integer truncation of tensor dimensions …	There are no reported fixed by versions.
PYSEC-2026-2298 Aliases: CVE-2026-34756 GHSA-3mwp-wvh9-7528	vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.19.0, a Denial of …	0.19.0 Vulnerable
PYSEC-2026-3407 Aliases: CVE-2026-9540 GHSA-98f3-hwg4-4rf7	vllm has Improper Resource Shutdown or Release A vulnerability was identified in vllm-project vllm 0.19.0. This issue affects some unknown …	There are no reported fixed by versions.
PYSEC-2026-2015 Aliases: CVE-2025-66448 GHSA-8fr4-5q9j-m8gm	vLLM vulnerable to remote code execution via transformers_utils/get_config ### Summary `vllm` has a critical remote code execution vector in a …	0.11.1 Vulnerable
PYSEC-2026-2300 Aliases: CVE-2026-41523 GHSA-q8gq-377p-jq3r	vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in …	0.22.0 Vulnerable
PYSEC-2026-3409 Aliases: CVE-2026-44222 GHSA-hpv8-x276-m59f	vLLM Vulnerable to Remote DoS via Special-Token Placeholders ## Summary This report explains a Token Injection vulnerability in vLLM’s multimodal …	0.20.0 Vulnerable
PYSEC-2026-2020 Aliases: CVE-2026-24779 GHSA-qh4c-xf7m-gxfc	vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector ### Summary A Server-Side Request Forgery (SSRF) vulnerability exists in the …	0.14.1 Vulnerable
PYSEC-2026-3404 Aliases: CVE-2026-54233 GHSA-6pr9-rp53-2pmc	vLLM: OOM Denial of Service via Audio Decompression Bomb ### Summary vLLM's `/v1/audio/transcriptions` endpoint limits compressed upload size but not …	There are no reported fixed by versions.
PYSEC-2026-3408 Aliases: CVE-2026-54236 GHSA-hgg8-fqqc-vfmw	vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router # vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses …	There are no reported fixed by versions.
PYSEC-2026-2011 Aliases: CVE-2025-6242 GHSA-3f6c-7fw2-ppm4	vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class ### Summary A Server-Side Request Forgery (SSRF) vulnerability exists …	0.11.0 Vulnerable
PYSEC-2026-2021 Aliases: CVE-2025-48956 GHSA-rxc4-3w6r-4v47	vllm API endpoints vulnerable to Denial of Service Attacks ### Summary A Denial of Service (DoS) vulnerability can be triggered …	0.10.1.1 Vulnerable
PYSEC-2026-3937 Aliases: CVE-2026-73555 GHSA-hwrm-c4cx-rf4j	vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages ## Summary When the vLLM API receives a malformed …	0.26.0 Vulnerable
PYSEC-2026-3936 Aliases: CVE-2026-71486 GHSA-8737-qx52-hjff	vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds ## Summary The `/v1/completions/derender` and `/v1/chat/completions/derender` endpoints accept caller-supplied …	0.26.0 Vulnerable
PYSEC-2026-3933 Aliases: CVE-2026-73556 GHSA-48jh-3gj7-fg8v	vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m ### Summary The fix …	0.26.0 Vulnerable
PYSEC-2026-3935 Aliases: CVE-2026-73558 GHSA-7m6h-x95x-82q5	vLLM: Cross-User Data Leak Vulnerability ### Summary An integer overflow in the act_and_mul_kernel kernel can cause the output of one …	0.27.0 Vulnerable
PYSEC-2026-3934 Aliases: CVE-2026-73560 GHSA-4hhp-h66f-j5j7	vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections ### Summary `vllm/transformers_utils/processors/mimo_v2_omni.py` — …	0.26.0 Vulnerable
GHSA-vfm7-4h43-gp6m	Duplicate Advisory: vLLM Vulnerable to Regular Expression Denial of Service ### Duplicate Advisory This advisory has been withdrawn because it …	0.9.0 Vulnerable
PYSEC-2026-3985 Aliases: CVE-2026-90553 GHSA-3c86-2m5g-59q7	vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when …	0.28.0 Vulnerable
PYSEC-2026-4008 Aliases: CVE-2026-94626	vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded …	0.30.0 Vulnerable
PYSEC-2026-4003 Aliases: CVE-2026-78684 GHSA-cqm8-jxg6-fqfq	vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. …	0.27.0 Vulnerable
PYSEC-2026-4006 Aliases: CVE-2026-94624 GHSA-frvg-qw88-hww9	vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and …	0.30.0 Vulnerable
PYSEC-2026-4004 Aliases: CVE-2026-94622	vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. …	0.30.0 Vulnerable
PYSEC-2026-3999 Aliases: CVE-2026-93841	vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence …	0.30.0 Vulnerable
PYSEC-2026-3998 Aliases: CVE-2026-93840	vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token …	0.29.0 Vulnerable
PYSEC-2026-4005 Aliases: CVE-2026-94623	vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly …	0.30.0 Vulnerable
PYSEC-2026-4178 Aliases: CVE-2026-69147 GHSA-8pw2-6jv3-mj5j	vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation ## Summary Current vLLM `main` lets an inference request choose the …	0.28.0 Vulnerable
PYSEC-2026-3996 Aliases: CVE-2026-93436	vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers …	0.30.0 Vulnerable
PYSEC-2026-4007 Aliases: CVE-2026-94625	vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are …	0.30.0 Vulnerable
PYSEC-2026-4000 Aliases: CVE-2026-93989	vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can …	0.30.0 Vulnerable
PYSEC-2026-3997 Aliases: CVE-2026-93592 GHSA-25q3-v2hm-8vpf	vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing …	0.28.0 Vulnerable
PYSEC-2026-4179 Aliases: CVE-2026-57173 GHSA-hcwq-8wjf-3gcr	vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions ### Summary The audio decode-duration guard (`max_duration_s`, env `VLLM_MAX_AUDIO_DECODE_DURATION_S`, default 600s) that protects …	0.24.0 Vulnerable
PYSEC-2026-4198 Aliases: CVE-2026-105755 GHSA-2phq-3phc-84px	vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score …	0.30.0 Vulnerable
PYSEC-2026-4186 Aliases: CVE-2026-103241	A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs …	0.27.0 Vulnerable
PYSEC-2026-4197 Aliases: CVE-2026-105753 GHSA-ph3r-5jfg-f84f	vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache …	0.28.0 Vulnerable
PYSEC-2026-4199 Aliases: CVE-2026-105757 GHSA-85xf-c7hm-whqw	vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped …	0.30.0 Vulnerable
PYSEC-2026-4184 Aliases: CVE-2026-100650 GHSA-p6g9-7v3x-m8mv	vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio …	0.30.0 Vulnerable
PYSEC-2026-4308 Aliases: CVE-2026-105752 GHSA-935w-9g4m-p28p	vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle ## Affected - Ecosystem / package: pip …	0.30.0 Vulnerable
PYSEC-2026-4306 Aliases: CVE-2026-105756 GHSA-2823-qmq8-rwvj	vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service …	0.30.0 Vulnerable
PYSEC-2026-4319 Aliases: CVE-2026-105922	A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file …	0.32.0 Vulnerable
PYSEC-2026-4309 Aliases: CVE-2026-105754 GHSA-ph72-cqr5-qpp7	vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features ## Affected - Ecosystem / package: pip / `vllm` - Affected versions: …	0.30.0 Vulnerable
PYSEC-2026-4325 Aliases: CVE-2026-105759 GHSA-5fj9-pfhr-6j48	vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records …	0.30.0 Vulnerable
GHSA-p92p-rxj5-7p2x Aliases: CVE-2026-114050	vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine ## Summary Multimodal …	0.31.0 Vulnerable
GHSA-frvg-qw88-hww9 Aliases: CVE-2026-94624	vllm p2p never connected zmq_exhaustion ### Summary When the `OffloadingConnector` uses `TieringOffloadingSpec` with a P2P secondary tier, an API client …	0.32.0 Vulnerable
GHSA-8qpc-6rxx-4pxf	Duplicate Advisory: vllm p2p never connected zmq_exhaustion ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate …	0.30.0 Vulnerable
GHSA-h3rc-j82p-2c3h Aliases: CVE-2026-115915	vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE ### Summary In vLLM 0.30.0, `ImageMediaIO` passes attacker-controlled …	0.32.0 Vulnerable
GHSA-8397-8qf6-f2gm Aliases: CVE-2026-115913	vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine ### …	0.32.0 Vulnerable
PYSEC-2026-4347 Aliases: CVE-2026-115916 GHSA-q97c-p368-75c4	vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one …	0.32.0 Vulnerable
PYSEC-2026-4348 Aliases: CVE-2026-115917 GHSA-vvpg-rrww-wpmh	vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware …	0.32.0 Vulnerable
PYSEC-2026-4345 Aliases: CVE-2026-115912 GHSA-6757-hggm-hp2w	vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged …	0.32.0 Vulnerable
PYSEC-2026-4362 Aliases: CVE-2026-114054 GHSA-rh6f-3x46-j33q	vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled …	0.31.0 Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	4.4