vllm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-12491Mediumvllm: vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations CVE-2026-54235Mediumvllm: vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels CVE-2026-48746Criticalvllm: vLLM: OpenAI auth bypass CVE-2026-41523Highvllm: vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution CVE-2026-5497Highvllm: vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the…CVE-2026-47155Mediumvllm: vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors CVE-2026-9540Mediumvllm: vllm has Improper Resource Shutdown or Release CVE-2026-44223Mediumvllm: vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters CVE-2026-44222Mediumvllm: vLLM Vulnerable to Remote DoS via Special-Token Placeholders CVE-2026-7141Lowvllm: vLLM makes Use of Uninitialized Resource CVE-2026-34755Mediumvllm: vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing CVE-2026-34753Mediumvllm: vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `CVE-2026-34756Mediumvllm: vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server CVE-2026-27893Highvllm: vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out CVE-2026-25960Mediumvllm: vLLM has SSRF Protection Bypass CVE-2026-22778Criticalvllm: vLLM has RCE In Video Processing CVE-2026-24779Highvllm: vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector CVE-2026-22807Highvllm: vLLM affected by RCE via auto_map dynamic module loading during model initialization CVE-2026-22773Mediumvllm: vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions CVE-2026-56340Highvllm: vLLM introduced enhanced protection for CVE-2025-62164 CVE-2025-66448Highvllm: vLLM vulnerable to remote code execution via transformers_utils/get_config CVE-2025-62426Mediumvllm: vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`CVE-2025-62372Highvllm: vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs CVE-2025-62164Highvllm: vLLM deserialization vulnerability leading to DoS and potential RCE CVE-2025-6242Highvllm: vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.