vllm
- Software type
- AI and machine learning platform
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, vllm recorded 74 security vulnerabilities in the last 90 days, of which 33 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of vllm and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-94623vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion FailureCVE-2026-94622vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer MetadataCVE-2026-93989vLLM through 0.29.0 Cross-Request Logits Corruption via bad_wordsCVE-2026-93841vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDsCVE-2026-93840vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-94623vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-94622vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata | Exploitation statusNot exploited | FixYes | Published09/21/2026 | SeverityHigh |
|---|
CVE-2026-93989vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words | Exploitation statusNot exploited | FixYes | Published09/19/2026 | SeverityLow |
|---|
CVE-2026-93841vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs | Exploitation statusNot exploited | FixYes | Published09/18/2026 | SeverityMedium |
|---|
CVE-2026-93840vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids | Exploitation statusNot exploited | FixYes | Published09/18/2026 | SeverityMedium |
|---|
CVE-2026-93592vLLM before 0.28.0 Denial of Service via negative token ID | Exploitation statusActively exploited | FixYes | Published09/18/2026 | SeverityHigh |
|---|
CVE-2026-93436vLLM through 0.29.0 Memory Exhaustion via Rejected Requests | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityHigh |
|---|
CVE-2026-92365vllm-project vllm thinking_budget_state.py algorithmic complexity | Exploitation statusNot exploited | FixYes | Published09/16/2026 | SeverityMedium |
|---|
CVE-2026-92220vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumption | Exploitation statusNot exploited | FixYes | Published09/16/2026 | SeverityMedium |
|---|
CVE-2026-69147vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation | Exploitation statusActively exploited | FixYes | Published09/16/2026 | SeverityMedium |
|---|
CVE-2026-57173vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions | Exploitation statusNot exploited | FixYes | Published09/16/2026 | SeverityMedium |
|---|
CVE-2026-90878vllm-project vLLM Jinja Template Rendering completions resource consumption | Exploitation statusActively exploited | FixYes | Published09/15/2026 | SeverityMedium |
|---|
CVE-2026-90713vllm-project vLLM tiktoken vocab File mod.rs new denial of service | Exploitation statusActively exploited | FixYes | Published09/14/2026 | SeverityMedium |
|---|
CVE-2026-90555vLLM before 0.28.0 Denial of Service via Audio Header | Exploitation statusNot exploited | FixYes | Published09/12/2026 | SeverityHigh |
|---|
CVE-2026-90554vLLM before 0.28.0 Denial of Service via audio extraction | Exploitation statusNot exploited | FixYes | Published09/12/2026 | SeverityMedium |
|---|
CVE-2026-90553vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor | Exploitation statusNot exploited | FixYes | Published09/12/2026 | SeverityHigh |
|---|
CVE-2026-78684vLLM before 0.27.0 Denial of Service via DeepStream Backend | Exploitation statusNot exploited | FixYes | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-73560vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections | Exploitation statusActively exploited | FixYes | Published08/17/2026 | SeverityMedium |
|---|
CVE-2026-71486vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds | Exploitation statusNot exploited | FixYes | Published08/17/2026 | SeverityMedium |
|---|
CVE-2026-73559vLLM: Completion prompt lists fan out into unbounded engine requests | Exploitation statusActively exploited | FixYes | Published08/13/2026 | SeverityMedium |
|---|
CVE-2026-73558vLLM: Cross-User Data Leak Vulnerability | Exploitation statusActively exploited | FixYes | Published08/13/2026 | SeverityMedium |
|---|
CVE-2026-73557vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts | Exploitation statusNot exploited | FixYes | Published08/13/2026 | SeverityMedium |
|---|
CVE-2026-73556vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574 | Exploitation statusActively exploited | FixYes | Published08/13/2026 | SeverityMedium |
|---|
CVE-2026-73555vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages | Exploitation statusNot exploited | FixYes | Published08/13/2026 | SeverityMedium |
|---|
CVE-2026-55646vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit | Exploitation statusActively exploited | FixYes | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-55574vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends | Exploitation statusNot exploited | FixYes | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-55514vLLM denial of service via prompt embeds on M-RoPE models | Exploitation statusNot exploited | FixYes | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-54234vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection | Exploitation statusActively exploited | FixYes | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-54236vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router | Exploitation statusActively exploited | FixYes | Published06/22/2026 | SeverityMedium |
|---|
CVE-2026-54235vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels | Exploitation statusNot exploited | FixYes | Published06/22/2026 | SeverityMedium |
|---|
CVE-2026-54233vLLM: OOM Denial of Service via Audio Decompression Bomb | Exploitation statusNot exploited | FixYes | Published06/22/2026 | SeverityMedium |
|---|
CVE-2026-54232vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile | Exploitation statusNot exploited | FixYes | Published06/22/2026 | SeverityHigh |
|---|
CVE-2026-53923vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflow | Exploitation statusNot exploited | FixYes | Published06/22/2026 | SeverityMedium |
|---|
CVE-2026-48746vLLM: OpenAI auth bypass | Exploitation statusActively exploited | FixYes | Published06/22/2026 | SeverityCritical |
|---|
CVE-2026-47155vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors | Exploitation statusNot exploited | FixYes | Published06/22/2026 | SeverityMedium |
|---|
CVE-2026-41523vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution | Exploitation statusNot exploited | FixYes | Published06/22/2026 | SeverityHigh |
|---|
CVE-2026-12491Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations | Exploitation statusNot exploited | FixYes | Published06/17/2026 | SeverityMedium |
|---|
CVE-2026-9540vllm-project vllm OpenAI-compatible Serving Path denial of service | Exploitation statusActively exploited | FixYes | Published05/26/2026 | SeverityMedium |
|---|
CVE-2026-44223vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters | Exploitation statusActively exploited | FixYes | Published05/12/2026 | SeverityMedium |
|---|
CVE-2026-44222vLLM: Remote DoS via Special-Token Placeholders | Exploitation statusNot exploited | FixYes | Published05/12/2026 | SeverityMedium |
|---|
CVE-2026-34756vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server | Exploitation statusNot exploited | FixYes | Published04/06/2026 | SeverityMedium |
|---|
CVE-2026-34755vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing | Exploitation statusNot exploited | FixYes | Published04/06/2026 | SeverityMedium |
|---|
CVE-2026-34753vLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url ` | Exploitation statusNot exploited | FixYes | Published04/06/2026 | SeverityMedium |
|---|
CVE-2026-34760vLLM: Downmix Implementation Differences as Attack Vectors Against Audio AI Models | Exploitation statusNot exploited | FixYes | Published04/02/2026 | SeverityMedium |
|---|
CVE-2026-27893vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out | Exploitation statusNot exploited | FixNo | Published03/26/2026 | SeverityHigh |
|---|
CVE-2026-25960SSRF Protection Bypass in vLLM | Exploitation statusNot exploited | FixNo | Published03/09/2026 | SeverityHigh |
|---|
CVE-2026-22778vLLM leaks a heap address when PIL throws an error | Exploitation statusNot exploited | FixYes | Published02/02/2026 | SeverityCritical |
|---|
CVE-2026-24779vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector` | Exploitation statusActively exploited | FixNo | Published01/27/2026 | SeverityHigh |
|---|
CVE-2026-22807vLLM affected by RCE via auto_map dynamic module loading during model initialization | Exploitation statusNot exploited | FixNo | Published01/21/2026 | SeverityHigh |
|---|
CVE-2026-22773vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions | Exploitation statusNot exploited | FixYes | Published01/10/2026 | SeverityMedium |
|---|
121 Results | Page 2 of 3