SSRF Protection Bypass in vLLM

vLLM leaks a heap address when PIL throws an error

vLLM affected by RCE via auto_map dynamic module loading during model initialization

vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints

vLLM: OpenAI auth bypass

vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile

vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out

vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision

vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor

vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors

vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override

vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs

vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs

vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate

vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID

vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)

vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service

vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids

vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision

vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size

vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions

vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure

vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata

vLLM before 0.28.0 Denial of Service via negative token ID

vLLM through 0.29.0 Memory Exhaustion via Rejected Requests

vLLM before 0.28.0 Denial of Service via audio extraction

vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection

vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflow

vLLM: Remote DoS via Special-Token Placeholders

vLLM: Downmix Implementation Differences as Attack Vectors Against Audio AI Models

vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`

vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs

vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

vLLM DeepSeek-OCR image processing vulnerable to denial of service

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool

vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids

vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions

vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys

vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features