vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574

vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service

vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words

vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

vLLM is an inference and serving engine for large language models (LLMs)

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs