vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

SSRF Protection Bypass in vLLM

vLLM leaks a heap address when PIL throws an error

vLLM affected by RCE via auto_map dynamic module loading during model initialization

vLLM, an inference and serving engine for large language models (LLMs), has an issue in versions 0.6.5 through 0.8.4 that ONLY impacts environments using the `PyNcclPipe` KV cache…

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs

vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function

vLLM: OpenAI auth bypass

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs

vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile

vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out

vLLM is an inference and serving engine for large language models (LLMs)

vLLM is an inference and serving engine for large language models (LLMs)

vLLM is a library for LLM inference and serving

vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

vLLM is an inference and serving engine for large language models

vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor

vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors

vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override

vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders

vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate

vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids

vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n

vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)

vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service

vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids

vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision

vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size

vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions

vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure

vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata

vLLM before 0.28.0 Denial of Service via negative token ID

vLLM through 0.29.0 Memory Exhaustion via Rejected Requests

vLLM before 0.28.0 Denial of Service via audio extraction

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion

vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection

vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflow

vLLM - Denial of Service via Unvalidated Multimodal Embeddings

vllm - Regular Expression Denial of Service in Multiple Components

Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm

vLLM: Remote DoS via Special-Token Placeholders

vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions

vLLM is an inference and serving engine for large language models (LLMs)

vLLM is an inference and serving engine for large language models (LLMs)

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs