vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys

vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids

vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass

vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization

vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

vLLM before 0.28.0 Denial of Service via Audio Header

vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

vLLM: Completion prompt lists fan out into unbounded engine requests

vLLM denial of service via prompt embeds on M-RoPE models

vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit

vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors

vLLM: OOM Denial of Service via Audio Decompression Bomb

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters

vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing

vLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url `

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding

vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs

vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids

vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumption

vLLM before 0.27.0 Denial of Service via DeepStream Backend

vLLM: Cross-User Data Leak Vulnerability

vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574

vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

vllm-project vllm OpenAI-compatible Serving Path denial of service

Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations

vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service

vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds

vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words

vllm-project vllm thinking_budget_state.py algorithmic complexity

vllm-project vLLM Jinja Template Rendering completions resource consumption

vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense

vllm-project vLLM tiktoken vocab File mod.rs new denial of service