VL
Vendor
vllm
94
CVEs
0
On KEV
11
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-105922 | VL Vllm Vllm | 4.3 | Oct 6 | vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service |
| CVE-2026-105760 | VL Vllm Vllm | 5.3 | Oct 5 | vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion |
| CVE-2026-105759 | VL Vllm Vllm | 7.5 | Oct 5 | vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service) |
| CVE-2026-105758 | VL Vllm Vllm | 5.3 | Oct 5 | vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach |
| CVE-2026-105757 | VL Vllm Vllm | 6.5 | Oct 5 | vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites) |
| CVE-2026-105756 | VL Vllm Vllm | 6.5 | Oct 5 | vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service |
| CVE-2026-105755 | VL Vllm Vllm | 4.2 | Oct 5 | vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank` |
| CVE-2026-105754 | VL Vllm Vllm | 6.5 | Oct 5 | vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features |
| CVE-2026-105753 | VL Vllm Vllm | 6.5 | Oct 5 | vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core |
| CVE-2026-105752 | VL Vllm Vllm | 3.1 | Oct 5 | vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle |
| CVE-2026-103241 | VL Vllm Vllm | 7.5 | Sep 30 | vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service |
| CVE-2026-100654 | VL Vllm Vllm | 6.5 | Sep 26 | vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids |
| CVE-2026-100653 | VL Vllm Vllm | 6.5 | Sep 26 | vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation |
| CVE-2026-100652 | VL Vllm Vllm | 7.5 | Sep 26 | vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids |
| CVE-2026-100651 | VL Vllm Vllm | 6.5 | Sep 26 | vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass |
| CVE-2026-100650 | VL Vllm Vllm | 6.5 | Sep 26 | vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization |
| CVE-2026-100649 | VL Vllm Vllm | 5.3 | Sep 26 | vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass |
| CVE-2026-100648 | VL Vllm Vllm | 5.3 | Sep 26 | vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding |
| CVE-2026-100647 | VL Vllm Vllm | 7.5 | Sep 26 | vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt |
| CVE-2026-94627 | VL Vllm Vllm | 7.5 | Sep 21 | vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision |
| CVE-2026-94626 | VL Vllm Vllm | 7.5 | Sep 21 | vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size |
| CVE-2026-94625 | VL Vllm Vllm | 5.3 | Sep 21 | vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders |
| CVE-2026-94624 | VL Vllm Vllm | 7.5 | Sep 21 | vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions |
| CVE-2026-94623 | VL Vllm Vllm | 7.5 | Sep 21 | vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure |
| CVE-2026-94622 | VL Vllm Vllm | 7.5 | Sep 21 | vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata |
| CVE-2026-93989 | VL Vllm Vllm | 4.3 | Sep 19 | vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words |
| CVE-2026-93841 | VL Vllm Vllm | 5.3 | Sep 18 | vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs |
| CVE-2026-93840 | VL Vllm Vllm | 5.3 | Sep 18 | vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids |
| CVE-2026-93592 | VL Vllm Vllm | 7.5 | Sep 18 | vLLM before 0.28.0 Denial of Service via negative token ID |
| CVE-2026-93436 | VL Vllm Vllm | 7.5 | Sep 17 | vLLM through 0.29.0 Memory Exhaustion via Rejected Requests |
| CVE-2026-69147 | VL Vllm Vllm | 6.5 | Sep 16 | vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation |
| CVE-2026-57173 | VL Vllm Vllm | 6.5 | Sep 16 | vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions |
| CVE-2026-90555 | VL Vllm Vllm | 6.5 | Sep 12 | vLLM before 0.28.0 Denial of Service via Audio Header |
| CVE-2026-90554 | VL Vllm Vllm | 7.5 | Sep 12 | vLLM before 0.28.0 Denial of Service via audio extraction |
| CVE-2026-90553 | VL Vllm Vllm | 7.8 | Sep 12 | vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor |
| CVE-2026-37237 | VL Vllm Vllm | 7.5 | Aug 28 | vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion |
| CVE-2026-78684 | VL Vllm Vllm | 5.3 | Aug 25 | vLLM before 0.27.0 Denial of Service via DeepStream Backend |
| CVE-2026-73560 | VL Vllm Vllm | 6.5 | Aug 17 | vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections |
| CVE-2026-71486 | VL Vllm Vllm | 4.3 | Aug 17 | vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds |
| CVE-2026-73559 | VL Vllm Vllm | 6.5 | Aug 13 | vLLM: Completion prompt lists fan out into unbounded engine requests |
| CVE-2026-73558 | VL Vllm Vllm | 5.3 | Aug 13 | vLLM: Cross-User Data Leak Vulnerability |
| CVE-2026-73557 | VL Vllm Vllm | 5.3 | Aug 13 | vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts |
| CVE-2026-73556 | VL Vllm Vllm | 5.3 | Aug 13 | vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574 |
| CVE-2026-73555 | VL Vllm Vllm | 5.3 | Aug 13 | vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages |
| CVE-2026-55514 | VL Vllm Vllm | 6.5 | Jul 6 | vLLM denial of service via prompt embeds on M-RoPE models |
| CVE-2026-55574 | VL Vllm Vllm | 7.5 | Jul 6 | vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends |
| CVE-2026-54234 | VL Vllm Vllm | 7.5 | Jul 6 | vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection |
| CVE-2026-55646 | VL Vllm Vllm | 6.5 | Jul 6 | vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit |
| CVE-2026-47155 | VL Vllm Vllm | 6.5 | Jun 22 | vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors |
| CVE-2026-41523 | VL Vllm Vllm | 7.5 | Jun 22 | vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution |
| CVE-2026-54232 | VL Vllm Vllm | 8.8 | Jun 22 | vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile |
| CVE-2026-54233 | VL Vllm Vllm | 6.5 | Jun 22 | vLLM: OOM Denial of Service via Audio Decompression Bomb |
| CVE-2026-54236 | VL Vllm Vllm | 5.3 | Jun 22 | vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router |
| CVE-2026-54235 | VL Vllm Vllm | 6.5 | Jun 22 | vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels |
| CVE-2026-48746 | VL Vllm Vllm | 9.1 | Jun 22 | vLLM: OpenAI auth bypass |
| CVE-2026-53923 | VL Vllm Vllm | 7.5 | Jun 22 | vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflow |
| CVE-2026-56340 | VL vLLM vLLM | 7.5 | Jun 20 | vLLM - Denial of Service via Unvalidated Multimodal Embeddings |
| CVE-2025-71379 | VL vllm vllm | 7.5 | Jun 20 | vllm - Regular Expression Denial of Service in Multiple Components |
| CVE-2026-5497 | VL Vllm Vllm | 7.5 | Jun 11 | Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm |
| CVE-2026-44223 | VL Vllm Vllm | 6.5 | May 12 | vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters |