vllm (PyPI)
Advisories
207
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.32.0 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "vllm>=0.32.0"poetry
poetry add "vllm>=0.32.0"uv
uv add "vllm>=0.32.0"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-8397-8qf6-f2gm vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine |
Medium EPSS 0.33% |
< 0.32.0 | 0.32.0 |
| GHSA-8397-8qf6-f2gm vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine |
Medium EPSS 0.33% |
< 0.32.0 | 0.32.0 |
| GHSA-x567-49g5-p4cf vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs |
Medium EPSS 0.35% |
>= 0.16.0, < 0.32.0 | 0.32.0 |
| GHSA-x567-49g5-p4cf vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs |
Medium EPSS 0.35% |
>= 0.16.0, < 0.32.0 | 0.32.0 |
| GHSA-x567-49g5-p4cf vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs |
Medium EPSS 0.35% |
>= 0.16.0, < 0.32.0 | 0.32.0 |
| GHSA-vvpg-rrww-wpmh vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server |
Medium EPSS 0.24% |
< 0.32.0 | 0.32.0 |
| GHSA-vvpg-rrww-wpmh vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server |
Medium EPSS 0.24% |
< 0.32.0 | 0.32.0 |
| GHSA-vvpg-rrww-wpmh vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server |
Medium EPSS 0.24% |
< 0.32.0 | 0.32.0 |
| GHSA-q97c-p368-75c4 vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) |
Medium EPSS 0.31% |
< 0.32.0 | 0.32.0 |
| GHSA-q97c-p368-75c4 vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) |
Medium EPSS 0.31% |
< 0.32.0 | 0.32.0 |
| GHSA-q97c-p368-75c4 vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) |
Medium EPSS 0.31% |
< 0.32.0 | 0.32.0 |
| GHSA-h3rc-j82p-2c3h vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE |
High EPSS 0.66% |
>= 0.30.0, < 0.32.0 | 0.32.0 |
| GHSA-h3rc-j82p-2c3h vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE |
High EPSS 0.66% |
< 0.32.0 | 0.32.0 |
| GHSA-h3rc-j82p-2c3h vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE |
High EPSS 0.66% |
< 0.32.0 | 0.32.0 |
| GHSA-gq5q-89c7-vhvx vLLM DeepSeek-OCR image processing vulnerable to denial of service |
Medium EPSS 0.40% |
>= 0.11.1, < 0.32.0 | 0.32.0 |
| GHSA-gq5q-89c7-vhvx vLLM DeepSeek-OCR image processing vulnerable to denial of service |
Medium EPSS 0.40% |
>= 0.11.1, < 0.32.0 | 0.32.0 |
| GHSA-6757-hggm-hp2w vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled |
High EPSS 0.51% |
< 0.32.0 | 0.32.0 |
| GHSA-6757-hggm-hp2w vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled |
High EPSS 0.51% |
< 0.32.0 | 0.32.0 |
| GHSA-6757-hggm-hp2w vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled |
High EPSS 0.51% |
< 0.32.0 | 0.32.0 |
| GHSA-542m-9234-8gvf vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool |
Medium EPSS 0.31% |
>= 0.19.0, < 0.32.0 | 0.32.0 |
| GHSA-542m-9234-8gvf vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool |
Medium EPSS 0.31% |
>= 0.19.0, < 0.32.0 | 0.32.0 |
| GHSA-542m-9234-8gvf vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool |
Medium EPSS 0.31% |
>= 0.19.0, < 0.32.0 | 0.32.0 |
| PYSEC-2026-4353 vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal… |
High EPSS 0.33% |
>= 0.20.0, < 0.30.0 | 0.30.0 |
| PYSEC-2026-4352 vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the… |
High EPSS 0.29% |
>= 0.10.2, < 0.25.0 | 0.25.0 |
| PYSEC-2026-4351 vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode… |
High EPSS 0.32% |
>= 0.9.2, < 0.24.0 | 0.24.0 |
| PYSEC-2026-4350 vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids… |
High EPSS 0.34% |
>= 0.22.0, < 0.24.0 | 0.24.0 |
| GHSA-f623-hjm8-5wg5 Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution Withdrawn |
High | >= 0.7.3, < 0.31.0 | 0.31.0 |
| GHSA-3cgq-c484-rx5j Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs Withdrawn |
High | >= 0.7.3 | No fix yet |
| GHSA-hfwf-hgvp-4rr8 Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization Withdrawn |
High | all versions | No fix yet |
| GHSA-gx7p-2j49-hfq4 vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.) |
High EPSS 0.42% |
>= 0.7.3, < 0.31.0 | 0.31.0 |
| GHSA-h3rc-6mm3-gc2m vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution |
Critical EPSS 0.46% |
>= 0.7.3, < 0.31.0 | 0.31.0 |
| GHSA-p92p-rxj5-7p2x vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine |
High EPSS 0.20% |
< 0.31.0 | 0.31.0 |
| PYSEC-2026-4319 A security flaw has been discovered in vllm-project vLLM up to 0.31.0. |
Medium EPSS 0.31% |
< 0.32.0 | 0.32.0 |
| GHSA-58v5-2m8f-94pr vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion |
Medium EPSS 0.30% |
>= 0.23.0rc2, < 0.30.0 | 0.30.0 |
| GHSA-58v5-2m8f-94pr vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion |
Medium EPSS 0.30% |
>= 0.23.0rc2, < 0.30.0 | 0.30.0 |
| PYSEC-2026-4325 vLLM is an inference and serving engine for large language models. |
High EPSS 0.41% |
< 0.30.0 | 0.30.0 |
| GHSA-x6mc-67gf-chw4 vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach |
Medium EPSS 0.30% |
>= 0.24.0, < 0.30.0 | 0.30.0 |
| GHSA-x6mc-67gf-chw4 vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach |
Medium EPSS 0.30% |
>= 0.24.0, < 0.30.0 | 0.30.0 |
| GHSA-85xf-c7hm-whqw vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites) |
Medium EPSS 0.31% |
< 0.30.0 | 0.30.0 |
| GHSA-85xf-c7hm-whqw vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites) |
Medium EPSS 0.31% |
< 0.30.0 | 0.30.0 |
| GHSA-2823-qmq8-rwvj vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service |
Medium EPSS 0.33% |
< 0.30.0 | 0.30.0 |
| GHSA-2823-qmq8-rwvj vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service |
Medium EPSS 0.33% |
< 0.30.0 | 0.30.0 |
| GHSA-2phq-3phc-84px vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank` |
Medium EPSS 0.20% |
< 0.30.0 | 0.30.0 |
| GHSA-2phq-3phc-84px vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank` |
Medium EPSS 0.20% |
< 0.30.0 | 0.30.0 |
| GHSA-ph72-cqr5-qpp7 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features |
Medium EPSS 0.27% |
< 0.30.0 | 0.30.0 |
| GHSA-ph72-cqr5-qpp7 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features |
Medium EPSS 0.27% |
< 0.30.0 | 0.30.0 |
| GHSA-ph3r-5jfg-f84f vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core |
Medium EPSS 0.43% |
< 0.28.0 | 0.28.0 |
| GHSA-ph3r-5jfg-f84f vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core |
Medium EPSS 0.43% |
< 0.28.0 | 0.28.0 |
| GHSA-935w-9g4m-p28p vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle |
Low EPSS 0.22% |
< 0.30.0 | 0.30.0 |
| GHSA-935w-9g4m-p28p vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle |
Low EPSS 0.22% |
< 0.30.0 | 0.30.0 |
| PYSEC-2026-4186 A flaw has been found in vllm-project vLLM up to 0.26.0. |
Medium EPSS 0.71% |
< 0.27.0 | 0.27.0 |
| PYSEC-2026-4324 vLLM is an inference and serving engine for large language models. |
Medium EPSS 0.34% |
>= 0.22.1, < 0.28.0 | 0.28.0 |
| PYSEC-2026-4185 vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token… |
High EPSS 0.42% |
>= 0.22.0, < 0.24.0 | 0.24.0 |
| PYSEC-2026-4184 vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB… |
Medium EPSS 0.81% |
< 0.30.0 | 0.30.0 |
| GHSA-8qpc-6rxx-4pxf Duplicate Advisory: vllm p2p never connected zmq_exhaustion Withdrawn |
High | < 0.30.0 | 0.30.0 |
| PYSEC-2026-4008 vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate… |
High EPSS 0.63% |
< 0.30.0 | 0.30.0 |
| PYSEC-2026-4007 vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders… |
Medium EPSS 0.52% |
< 0.30.0 | 0.30.0 |
| GHSA-frvg-qw88-hww9 vllm p2p never connected zmq_exhaustion |
High EPSS 0.43% |
< 0.32.0 | 0.32.0 |
| GHSA-frvg-qw88-hww9 vllm p2p never connected zmq_exhaustion |
High EPSS 0.43% |
< 0.30.0 | 0.30.0 |
| PYSEC-2026-4005 vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block… |
High EPSS 0.63% |
< 0.30.0 | 0.30.0 |
| PYSEC-2026-4004 vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. |
High EPSS 0.63% |
< 0.30.0 | 0.30.0 |
| PYSEC-2026-4000 vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). |
Low EPSS 0.20% |
< 0.30.0 | 0.30.0 |
| PYSEC-2026-3999 vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset… |
Medium EPSS 0.24% |
< 0.30.0 | 0.30.0 |
| PYSEC-2026-3998 vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). |
Medium EPSS 0.25% |
< 0.29.0 | 0.29.0 |
| PYSEC-2026-3997 vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to… |
High EPSS 0.54% |
< 0.28.0 | 0.28.0 |
| PYSEC-2026-3996 vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. |
High EPSS 0.76% |
< 0.30.0 | 0.30.0 |
| GHSA-8pw2-6jv3-mj5j vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation |
Medium EPSS 0.58% |
< 0.28.0 | 0.28.0 |
| GHSA-8pw2-6jv3-mj5j vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation |
Medium EPSS 0.58% |
< 0.28.0 | 0.28.0 |
| GHSA-hcwq-8wjf-3gcr vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions |
Medium EPSS 0.73% |
< 0.24.0 | 0.24.0 |
| GHSA-hcwq-8wjf-3gcr vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions |
Medium EPSS 0.73% |
< 0.24.0 | 0.24.0 |
| PYSEC-2026-3985 vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when… |
High EPSS 0.31% |
< 0.28.0 | 0.28.0 |
| PYSEC-2026-4003 vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. |
Medium EPSS 0.61% |
< 0.27.0 | 0.27.0 |
| GHSA-4hhp-h66f-j5j7 vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections |
Medium EPSS 0.41% |
< 0.26.0 | 0.26.0 |
| GHSA-4hhp-h66f-j5j7 vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections |
Medium EPSS 0.41% |
< 0.26.0 | 0.26.0 |
| GHSA-8737-qx52-hjff vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds |
Medium EPSS 0.37% |
< 0.26.0 | 0.26.0 |
| GHSA-8737-qx52-hjff vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds |
Medium EPSS 0.37% |
< 0.26.0 | 0.26.0 |
| GHSA-87x5-vmc3-756j vLLM: Completion prompt lists fan out into unbounded engine requests |
Medium EPSS 0.58% |
>= 0.19.0, < 0.26.0 | 0.26.0 |
| GHSA-87x5-vmc3-756j vLLM: Completion prompt lists fan out into unbounded engine requests |
Medium EPSS 0.58% |
>= 0.19.0, < 0.26.0 | 0.26.0 |
| GHSA-7m6h-x95x-82q5 vLLM: Cross-User Data Leak Vulnerability |
Medium EPSS 0.41% |
< 0.27.0 | 0.27.0 |
| GHSA-7m6h-x95x-82q5 vLLM: Cross-User Data Leak Vulnerability |
Medium EPSS 0.41% |
< 0.27.0 | 0.27.0 |
| GHSA-pr7f-p5mw-fc87 vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts |
Medium EPSS 0.25% |
>= 0.21.0, < 0.26.0 | 0.26.0 |
| GHSA-pr7f-p5mw-fc87 vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts |
Medium EPSS 0.25% |
>= 0.21.0, < 0.26.0 | 0.26.0 |
| GHSA-48jh-3gj7-fg8v vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m |
Medium EPSS 0.52% |
< 0.26.0 | 0.26.0 |
| GHSA-48jh-3gj7-fg8v vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m |
Medium EPSS 0.52% |
< 0.26.0 | 0.26.0 |
| GHSA-hwrm-c4cx-rf4j vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages |
Medium EPSS 0.41% |
< 0.26.0 | 0.26.0 |
| GHSA-hwrm-c4cx-rf4j vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages |
Medium EPSS 0.41% |
< 0.26.0 | 0.26.0 |
| GHSA-rwxx-mrjm-wc2m vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends |
High EPSS 0.58% |
< 0.24.0 | 0.24.0 |
| GHSA-rwxx-mrjm-wc2m vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends |
High EPSS 0.58% |
< 0.24.0 | 0.24.0 |
| GHSA-33cg-gxv8-3p8g vLLM denial of service via prompt embeds on M-RoPE models |
Medium EPSS 0.66% |
>= 0.12.0, < 0.24.0 | 0.24.0 |
| GHSA-33cg-gxv8-3p8g vLLM denial of service via prompt embeds on M-RoPE models |
Medium EPSS 0.66% |
>= 0.12.0, < 0.24.0 | 0.24.0 |
| GHSA-8wr5-jm2h-8r4f vLLM has Remote DoS via Invalid Recovered Token Reinjection |
High EPSS 0.62% |
>= 0.17.1, < 0.24.0 | 0.24.0 |
| GHSA-8wr5-jm2h-8r4f vLLM has Remote DoS via Invalid Recovered Token Reinjection |
High EPSS 0.62% |
>= 0.17.1, < 0.24.0 | 0.24.0 |
| GHSA-v82g-2437-67m2 vLLM: Speech-to-text upload size limit is enforced after full UploadFile read |
Medium EPSS 0.52% |
>= 0.22.0, < 0.24.0 | 0.24.0 |
| GHSA-v82g-2437-67m2 vLLM: Speech-to-text upload size limit is enforced after full UploadFile read |
Medium EPSS 0.52% |
>= 0.22.0, < 0.24.0 | 0.24.0 |
| PYSEC-2026-227 vLLM is an inference and serving engine for large language models (LLMs). |
High EPSS 0.56% |
< 0.22.1 | 0.22.1 |
| GHSA-vfm7-4h43-gp6m Duplicate Advisory: vLLM Vulnerable to Regular Expression Denial of Service Withdrawn |
Medium | >= 0.6.3, < 0.9.0 | 0.9.0 |
| GHSA-78fp-cf4h-g36p Duplicate Advisory: vLLM introduced enhanced protection for CVE-2025-62164 Withdrawn |
High | >= 0.10.2, < 0.13.0 | 0.13.0 |
| GHSA-x8xr-mj9x-6h7w Duplicate Advisory: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations Withdrawn |
Medium | >= 0.11.0, <= 0.23.0 | No fix yet |
| GHSA-6pr9-rp53-2pmc vLLM: OOM Denial of Service via Audio Decompression Bomb |
Medium EPSS 0.42% |
< 0.24.0 | 0.24.0 |
| GHSA-6pr9-rp53-2pmc vLLM: OOM Denial of Service via Audio Decompression Bomb |
Medium EPSS 0.42% |
<= 0.23.0 | No fix yet |
| GHSA-hgg8-fqqc-vfmw vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router |
Medium EPSS 0.93% |
< 0.24.0 | 0.24.0 |
| GHSA-hgg8-fqqc-vfmw vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router |
Medium EPSS 0.93% |
<= 0.23.0 | No fix yet |
| GHSA-5jv2-g5wq-cmr4 vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving |
High EPSS 0.48% |
>= 0.5.5, < 0.24.0 | 0.24.0 |
| GHSA-5jv2-g5wq-cmr4 vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving |
High EPSS 0.48% |
>= 0.5.5, <= 0.23.0 | No fix yet |
| GHSA-7h4p-rffg-7823 vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels |
Medium EPSS 0.45% |
<= 0.23.0 | No fix yet |
| GHSA-7h4p-rffg-7823 vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels |
Medium EPSS 0.45% |
>= 0.8.5, < 0.24.0 | 0.24.0 |
| GHSA-8jr5-v98p-w75m vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations |
Medium EPSS 0.24% |
>= 0.11.0, < 0.24.0 | 0.24.0 |
| GHSA-8jr5-v98p-w75m vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations |
Medium EPSS 0.24% |
>= 0.11.0, <= 0.23.0 | No fix yet |
| GHSA-94f4-hr76-p5j6 vLLM: OpenAI auth bypass |
Critical EPSS 1.15% |
>= 0.3.0, < 0.22.0 | 0.22.0 |
| GHSA-94f4-hr76-p5j6 vLLM: OpenAI auth bypass |
Critical EPSS 1.15% |
>= 0.3.0, < 0.22.0 | 0.22.0 |
| GHSA-q8gq-377p-jq3r vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution |
High EPSS 0.91% |
< 0.22.0 | 0.22.0 |
| GHSA-q8gq-377p-jq3r vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution |
High EPSS 0.91% |
< 0.22.0 | 0.22.0 |
| GHSA-wcwg-c5fc-9vrc vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method |
High EPSS 0.54% |
>= 0.8.0, < 0.19.0 | 0.19.0 |
| GHSA-wcwg-c5fc-9vrc vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method |
High EPSS 0.54% |
>= 0.8.0, < 0.19.0 | 0.19.0 |
| GHSA-3ww4-5jv9-j5gm vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors |
Medium EPSS 0.25% |
< 0.22.0 | 0.22.0 |
| GHSA-3ww4-5jv9-j5gm vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors |
Medium EPSS 0.25% |
< 0.22.0 | 0.22.0 |
| GHSA-98f3-hwg4-4rf7 vllm has Improper Resource Shutdown or Release |
Medium EPSS 0.43% |
<= 0.19.0 | No fix yet |
| GHSA-98f3-hwg4-4rf7 vllm has Improper Resource Shutdown or Release |
Medium EPSS 0.43% |
<= 0.19.0 | No fix yet |
| GHSA-83vm-p52w-f9pw vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters |
Medium EPSS 0.37% |
>= 0.18.0, < 0.20.0 | 0.20.0 |
| GHSA-83vm-p52w-f9pw vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters |
Medium EPSS 0.37% |
>= 0.18.0, < 0.20.0 | 0.20.0 |
| GHSA-hpv8-x276-m59f vLLM Vulnerable to Remote DoS via Special-Token Placeholders |
High EPSS 0.41% |
>= 0.6.1, < 0.20.0 | 0.20.0 |
| GHSA-hpv8-x276-m59f vLLM Vulnerable to Remote DoS via Special-Token Placeholders |
High EPSS 0.41% |
>= 0.6.1, < 0.20.0 | 0.20.0 |
| GHSA-x368-4g9h-fvv4 vLLM makes Use of Uninitialized Resource |
Medium EPSS 0.29% |
< 0.19.1 | 0.19.1 |
| GHSA-x368-4g9h-fvv4 vLLM makes Use of Uninitialized Resource |
Medium EPSS 0.29% |
< 0.19.1 | 0.19.1 |
| GHSA-pq5c-rjhq-qp7p vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing |
Medium EPSS 0.46% |
>= 0.7.0, < 0.19.0 | 0.19.0 |
| GHSA-pq5c-rjhq-qp7p vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing |
Medium EPSS 0.46% |
>= 0.7.0, < 0.19.0 | 0.19.0 |
| GHSA-pf3h-qjgv-vcpr vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url ` |
Medium EPSS 0.25% |
>= 0.16.0, < 0.19.0 | 0.19.0 |
| GHSA-pf3h-qjgv-vcpr vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url ` |
Medium EPSS 0.25% |
>= 0.16.0, < 0.19.0 | 0.19.0 |
| GHSA-3mwp-wvh9-7528 vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server |
Medium EPSS 0.42% |
>= 0.1.0, < 0.19.0 | 0.19.0 |
| GHSA-3mwp-wvh9-7528 vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server |
Medium EPSS 0.42% |
>= 0.1.0, < 0.19.0 | 0.19.0 |
| GHSA-6c4r-fmh3-7rh8 vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models |
High EPSS 0.28% |
>= 0.5.5, < 0.18.0 | 0.18.0 |
| GHSA-6c4r-fmh3-7rh8 vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models |
High EPSS 0.28% |
>= 0.5.5, < 0.18.0 | 0.18.0 |
| GHSA-7972-pg2x-xr59 vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out |
High EPSS 1.37% |
>= 0.10.1, < 0.18.0 | 0.18.0 |
| GHSA-7972-pg2x-xr59 vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out |
High EPSS 1.37% |
>= 0.10.1, < 0.18.0 | 0.18.0 |
| GHSA-v359-jj2v-j536 vLLM has SSRF Protection Bypass |
Critical EPSS 0.57% |
>= 0.15.1, < 0.17.0 | 0.17.0 |
| GHSA-v359-jj2v-j536 vLLM has SSRF Protection Bypass |
Critical EPSS 0.57% |
>= 0.15.1, < 0.17.0 | 0.17.0 |
| GHSA-4r2x-xpjr-7cvv vLLM has RCE In Video Processing |
Critical EPSS 18.29% |
>= 0.8.3, < 0.14.1 | 0.14.1 |
| GHSA-4r2x-xpjr-7cvv vLLM has RCE In Video Processing |
Critical EPSS 18.29% |
>= 0.8.3, < 0.14.1 | 0.14.1 |
| GHSA-qh4c-xf7m-gxfc vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector |
High EPSS 0.58% |
< 0.14.1 | 0.14.1 |
| GHSA-qh4c-xf7m-gxfc vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector |
High EPSS 0.58% |
< 0.14.1 | 0.14.1 |
| GHSA-2pc9-4j83-qjmr vLLM affected by RCE via auto_map dynamic module loading during model initialization |
Critical EPSS 0.98% |
>= 0.10.1, < 0.14.0 | 0.14.0 |
| GHSA-2pc9-4j83-qjmr vLLM affected by RCE via auto_map dynamic module loading during model initialization |
Critical EPSS 0.98% |
>= 0.10.1, < 0.14.0 | 0.14.0 |
| GHSA-grg2-63fw-f2qr vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions |
High EPSS 0.44% |
>= 0.6.4, < 0.12.0 | 0.12.0 |
| GHSA-grg2-63fw-f2qr vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions |
High EPSS 0.44% |
>= 0.6.4, < 0.12.0 | 0.12.0 |
| GHSA-mcmc-2m55-j8jj vLLM introduced enhanced protection for CVE-2025-62164 |
High EPSS 0.64% |
>= 0.10.2, < 0.13.0 | 0.13.0 |
| GHSA-mcmc-2m55-j8jj vLLM introduced enhanced protection for CVE-2025-62164 |
High EPSS 0.64% |
>= 0.10.2, < 0.13.0 | 0.13.0 |
| GHSA-8fr4-5q9j-m8gm vLLM vulnerable to remote code execution via transformers_utils/get_config |
High EPSS 0.66% |
< 0.11.1 | 0.11.1 |
| GHSA-8fr4-5q9j-m8gm vLLM vulnerable to remote code execution via transformers_utils/get_config |
High EPSS 0.66% |
< 0.11.1 | 0.11.1 |
| GHSA-69j4-grxj-j64p vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs` |
Medium EPSS 0.54% |
>= 0.5.5, < 0.11.1 | 0.11.1 |
| GHSA-69j4-grxj-j64p vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs` |
Medium EPSS 0.54% |
>= 0.5.5, < 0.11.1 | 0.11.1 |
| GHSA-pmqf-x6x8-p7qw vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs |
Medium EPSS 0.41% |
>= 0.5.5, < 0.11.1 | 0.11.1 |
| GHSA-pmqf-x6x8-p7qw vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs |
Medium EPSS 0.41% |
>= 0.5.5, < 0.11.1 | 0.11.1 |
| GHSA-mrw7-hf4f-83pf vLLM deserialization vulnerability leading to DoS and potential RCE |
High EPSS 0.96% |
>= 0.10.2, < 0.11.1 | 0.11.1 |
| GHSA-mrw7-hf4f-83pf vLLM deserialization vulnerability leading to DoS and potential RCE |
High EPSS 0.96% |
>= 0.10.2, < 0.11.1 | 0.11.1 |
| GHSA-6fvq-23cw-5628 vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server |
Medium | >= 0.5.1, < 0.11.0 | 0.11.0 |
| GHSA-6fvq-23cw-5628 vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server |
Medium | >= 0.5.1, < 0.11.0 | 0.11.0 |
| GHSA-3f6c-7fw2-ppm4 vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class |
High EPSS 0.25% |
>= 0.5.0, < 0.11.0 | 0.11.0 |
| GHSA-3f6c-7fw2-ppm4 vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class |
High EPSS 0.25% |
>= 0.5.0, < 0.11.0 | 0.11.0 |
| GHSA-wr9h-g72x-mwhm vLLM is vulnerable to timing attack at bearer auth |
High EPSS 0.57% |
< 0.11.0 | 0.11.0 |
| GHSA-wr9h-g72x-mwhm vLLM is vulnerable to timing attack at bearer auth |
High EPSS 0.57% |
< 0.11.0 | 0.11.0 |
| GHSA-79j6-g2m3-jgfw vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder |
High | >= 0.10.0, < 0.10.1.1 | 0.10.1.1 |
| GHSA-79j6-g2m3-jgfw vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder |
High | >= 0.10.0, < 0.10.1.1 | 0.10.1.1 |
| GHSA-rxc4-3w6r-4v47 vllm API endpoints vulnerable to Denial of Service Attacks |
High EPSS 0.56% |
>= 0.1.0, < 0.10.1.1 | 0.10.1.1 |
| GHSA-rxc4-3w6r-4v47 vllm API endpoints vulnerable to Denial of Service Attacks |
High EPSS 0.56% |
>= 0.1.0, < 0.10.1.1 | 0.10.1.1 |
| GHSA-vrq3-r879-7m65 vLLM Tool Schema allows DoS via Malformed pattern and type Fields |
Medium EPSS 0.64% |
>= 0.8.0, < 0.9.0 | 0.9.0 |
| GHSA-vrq3-r879-7m65 vLLM Tool Schema allows DoS via Malformed pattern and type Fields |
Medium EPSS 0.64% |
>= 0.8.0, < 0.9.0 | 0.9.0 |
| GHSA-9hcf-v7m4-6m2j vLLM allows clients to crash the openai server with invalid regex |
Medium EPSS 0.51% |
>= 0.8.0, < 0.9.0 | 0.9.0 |
| GHSA-9hcf-v7m4-6m2j vLLM allows clients to crash the openai server with invalid regex |
Medium EPSS 0.51% |
>= 0.8.0, < 0.9.0 | 0.9.0 |
| GHSA-6qc9-v4r8-22xg vLLM DOS: Remotely kill vllm over http with invalid JSON schema |
Medium EPSS 0.57% |
>= 0.8.0, < 0.9.0 | 0.9.0 |
| GHSA-6qc9-v4r8-22xg vLLM DOS: Remotely kill vllm over http with invalid JSON schema |
Medium EPSS 0.57% |
>= 0.8.0, < 0.9.0 | 0.9.0 |
| GHSA-c65p-x677-fgj6 vLLM has a Weakness in MultiModalHasher Image Hashing Implementation |
High EPSS 0.34% |
>= 0.7.0, < 0.9.0 | 0.9.0 |
| GHSA-c65p-x677-fgj6 vLLM has a Weakness in MultiModalHasher Image Hashing Implementation |
High EPSS 0.34% |
< 0.9.0 | 0.9.0 |
| GHSA-4qjh-9fv9-r85r Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching |
Low EPSS 0.43% |
< 0.9.0 | 0.9.0 |
| GHSA-4qjh-9fv9-r85r Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching |
Low EPSS 0.43% |
< 0.9.0 | 0.9.0 |
| GHSA-j828-28rj-hfhp vLLM vulnerable to Regular Expression Denial of Service |
Medium EPSS 0.48% |
>= 0.6.3, < 0.9.0 | 0.9.0 |
| GHSA-w6q7-j642-7c25 vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py` |
Medium EPSS 0.54% |
>= 0.6.4, < 0.9.0 | 0.9.0 |
| GHSA-w6q7-j642-7c25 vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py` |
Medium EPSS 0.54% |
>= 0.6.4, < 0.9.0 | 0.9.0 |
| GHSA-hjq4-87xh-g4fv vLLM Allows Remote Code Execution via PyNcclPipe Communication Service |
Critical EPSS 0.96% |
>= 0.6.5, < 0.8.5 | 0.8.5 |
| GHSA-hjq4-87xh-g4fv vLLM Allows Remote Code Execution via PyNcclPipe Communication Service |
Critical EPSS 0.96% |
>= 0.6.5, < 0.8.5 | 0.8.5 |
| GHSA-9pcc-gvx5-r5wm Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration |
High EPSS 0.56% |
>= 0.5.2, < 0.10.0 | 0.10.0 |
| GHSA-9pcc-gvx5-r5wm Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration |
High EPSS 0.56% |
>= 0.5.2, < 0.10.0 | 0.10.0 |
| GHSA-vc6m-hm49-g9qg vLLM: Quadratic Time Complexity in Input Token Processing leads to denial of service |
High EPSS 0.53% |
>= 0.8.0, < 0.8.5 | 0.8.5 |
| GHSA-vc6m-hm49-g9qg vLLM: Quadratic Time Complexity in Input Token Processing leads to denial of service |
High EPSS 0.53% |
>= 0.8.0, < 0.8.5 | 0.8.5 |
| GHSA-hj4w-hm2g-p6w5 vLLM Vulnerable to Remote Code Execution via Mooncake Integration |
Critical EPSS 1.82% |
>= 0.6.5, < 0.8.5 | 0.8.5 |
| GHSA-hj4w-hm2g-p6w5 vLLM Vulnerable to Remote Code Execution via Mooncake Integration |
Critical EPSS 1.82% |
>= 0.6.5, < 0.8.5 | 0.8.5 |
| GHSA-9f8f-2vmf-885j Data exposure via ZeroMQ on multi-node vLLM deployment |
High EPSS 0.61% |
>= 0.5.2, < 0.8.5 | 0.8.5 |
| GHSA-9f8f-2vmf-885j Data exposure via ZeroMQ on multi-node vLLM deployment |
High EPSS 0.61% |
>= 0.5.2, < 0.8.5 | 0.8.5 |
| GHSA-ggpf-24jw-3fcw CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0 |
Critical | < 0.8.0 | 0.8.0 |
| GHSA-hf3c-wxg2-49q9 vLLM vulnerable to Denial of Service by abusing xgrammar cache |
Medium | >= 0.6.5, < 0.8.4 | 0.8.4 |
| GHSA-cj47-qj6g-x7r4 vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints |
Critical EPSS 1.38% |
<= 0.6.0 | No fix yet |
| GHSA-cj47-qj6g-x7r4 vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints |
Critical EPSS 1.38% |
<= 0.6.0 | No fix yet |
| GHSA-pgr7-mhp5-fgjp vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object |
Critical | <= 0.8.1 | No fix yet |
| GHSA-pgr7-mhp5-fgjp vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object |
Critical | <= 0.8.1 | No fix yet |
| GHSA-5vqr-wprc-cpp7 vLLM Deserialization of Untrusted Data vulnerability |
Critical EPSS 1.72% |
<= 0.6.2 | No fix yet |
| GHSA-5vqr-wprc-cpp7 vLLM Deserialization of Untrusted Data vulnerability |
Critical EPSS 1.72% |
<= 0.6.2 | No fix yet |
| GHSA-x3m8-f7g5-qhm7 vLLM Allows Remote Code Execution via Mooncake Integration |
Critical EPSS 1.82% |
>= 0.6.5, < 0.8.0 | 0.8.0 |
| GHSA-x3m8-f7g5-qhm7 vLLM Allows Remote Code Execution via Mooncake Integration |
Critical EPSS 1.82% |
>= 0.6.5, < 0.8.0 | 0.8.0 |
| GHSA-mgrm-fgjv-mhv8 vLLM denial of service via outlines unbounded cache on disk |
Medium EPSS 0.47% |
< 0.8.0 | 0.8.0 |
| GHSA-mgrm-fgjv-mhv8 vLLM denial of service via outlines unbounded cache on disk |
Medium EPSS 0.47% |
< 0.8.0 | 0.8.0 |
| GHSA-rm76-4mrf-v9r8 vLLM uses Python 3.12 built-in hash() which leads to predictable hash collisions in prefix cache |
Low EPSS 0.19% |
< 0.7.2 | 0.7.2 |
| GHSA-rm76-4mrf-v9r8 vLLM uses Python 3.12 built-in hash() which leads to predictable hash collisions in prefix cache |
Low EPSS 0.19% |
< 0.7.2 | 0.7.2 |
| GHSA-rh4j-5rhw-hr54 vllm: Malicious model to RCE by torch.load in hf_model_weights_iterator |
High EPSS 0.87% |
< 0.7.0 | 0.7.0 |
| GHSA-rh4j-5rhw-hr54 vllm: Malicious model to RCE by torch.load in hf_model_weights_iterator |
High EPSS 0.87% |
< 0.7.0 | 0.7.0 |
| GHSA-wc36-9694-f9rf vLLM Denial of Service via the best_of parameter |
Medium EPSS 0.23% |
<= 0.5.0.post1 | No fix yet |
| GHSA-wc36-9694-f9rf vLLM Denial of Service via the best_of parameter |
Medium EPSS 0.23% |
<= 0.5.0.post1 | No fix yet |
| GHSA-w2r7-9579-27hf vLLM denial of service vulnerability |
High EPSS 0.68% |
< 0.5.5 | 0.5.5 |
| GHSA-w2r7-9579-27hf vLLM denial of service vulnerability |
High EPSS 0.68% |
< 0.5.5 | 0.5.5 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor