vllm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-73559Mediumvllm: vLLM: Completion prompt lists fan out into unbounded engine requests CVE-2026-55514Highvllm: vLLM denial of service via prompt embeds on M-RoPE models CVE-2026-55646Mediumvllm: vLLM: Speech-to-text upload size limit is enforced after full UploadFile read CVE-2026-55574Highvllm: vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends CVE-2026-54234Highvllm: vLLM has Remote DoS via Invalid Recovered Token Reinjection CVE-2026-34760Mediumvllm: vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models CVE-2026-54233Mediumvllm: vLLM: OOM Denial of Service via Audio Decompression Bomb CVE-2026-54236Mediumvllm: vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router CVE-2026-53923Mediumvllm: vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving CVE-2026-12491Mediumvllm: vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations CVE-2026-54235Mediumvllm: vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels CVE-2026-48746Criticalvllm: vLLM: OpenAI auth bypass CVE-2026-41523Highvllm: vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution CVE-2026-5497Highvllm: vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the…CVE-2026-47155Mediumvllm: vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors CVE-2026-9540Mediumvllm: vllm has Improper Resource Shutdown or Release CVE-2026-44223Mediumvllm: vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters CVE-2026-44222Mediumvllm: vLLM Vulnerable to Remote DoS via Special-Token Placeholders CVE-2026-7141Lowvllm: vLLM makes Use of Uninitialized Resource CVE-2026-34755Mediumvllm: vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing CVE-2026-34753Mediumvllm: vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `CVE-2026-34756Mediumvllm: vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server CVE-2026-27893Highvllm: vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out CVE-2026-25960Mediumvllm: vLLM has SSRF Protection Bypass CVE-2026-22778Criticalvllm: vLLM has RCE In Video Processing

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.