vllm
- Software type
- AI and machine learning platform
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, vllm recorded 74 security vulnerabilities in the last 90 days, of which 33 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of vllm and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2025-66448vLLM vulnerable to remote code execution via transformers_utils/get_configCVE-2025-62426vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`CVE-2025-62372vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputsCVE-2025-62164VLLM deserialization vulnerability leading to DoS and potential RCECVE-2025-59425vLLM vulnerable to timing attack at bearer auth| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2025-66448vLLM vulnerable to remote code execution via transformers_utils/get_config | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2025-62426vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs` | Exploitation statusNot exploited | FixYes | Published11/21/2025 | SeverityMedium |
|---|
CVE-2025-62372vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs | Exploitation statusNot exploited | FixYes | Published11/21/2025 | SeverityHigh |
|---|
CVE-2025-62164VLLM deserialization vulnerability leading to DoS and potential RCE | Exploitation statusNot exploited | FixYes | Published11/21/2025 | SeverityHigh |
|---|
CVE-2025-59425vLLM vulnerable to timing attack at bearer auth | Exploitation statusNot exploited | FixNo | Published10/07/2025 | SeverityHigh |
|---|
CVE-2025-48956vLLM API endpoints vulnerable to Denial of Service Attacks | Exploitation statusNot exploited | FixYes | Published08/21/2025 | SeverityHigh |
|---|
CVE-2025-48944vLLM Tool Schema allows DoS via Malformed pattern and type Fields | Exploitation statusActively exploited | FixNo | Published05/30/2025 | SeverityMedium |
|---|
CVE-2025-48943vLLM allows clients to crash the openai server with invalid regex | Exploitation statusNot exploited | FixNo | Published05/30/2025 | SeverityMedium |
|---|
CVE-2025-48942vLLM DOS: Remotely kill vllm over http with invalid JSON schema | Exploitation statusActively exploited | FixNo | Published05/30/2025 | SeverityMedium |
|---|
CVE-2025-48887vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py` | Exploitation statusActively exploited | FixNo | Published05/30/2025 | SeverityMedium |
|---|
CVE-2025-46722vLLM has a Weakness in MultiModalHasher Image Hashing Implementation | Exploitation statusNot exploited | FixYes | Published05/29/2025 | SeverityMedium |
|---|
CVE-2025-46570vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel | Exploitation statusNot exploited | FixYes | Published05/29/2025 | SeverityLow |
|---|
CVE-2025-47277vLLM Allows Remote Code Execution via PyNcclPipe Communication Service | Exploitation statusNot exploited | FixNo | Published05/20/2025 | SeverityCritical |
|---|
CVE-2025-30165Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration | Exploitation statusNot exploited | FixNo | Published05/06/2025 | SeverityHigh |
|---|
CVE-2025-46560vLLM phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of service | Exploitation statusActively exploited | FixYes | Published04/30/2025 | SeverityMedium |
|---|
CVE-2025-32444vLLM Vulnerable to Remote Code Execution via Mooncake Integration | Exploitation statusNot exploited | FixYes | Published04/30/2025 | SeverityCritical |
|---|
CVE-2025-30202Data exposure via ZeroMQ on multi-node vLLM deployment | Exploitation statusNot exploited | FixYes | Published04/30/2025 | SeverityHigh |
|---|
CVE-2025-29783vLLM Allows Remote Code Execution via Mooncake Integration | Exploitation statusNot exploited | FixYes | Published03/19/2025 | SeverityCritical |
|---|
CVE-2025-29770vLLM denial of service via outlines unbounded cache on disk | Exploitation statusNot exploited | FixYes | Published03/19/2025 | SeverityMedium |
|---|
CVE-2025-25183vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cache | Exploitation statusNot exploited | FixNo | Published02/07/2025 | SeverityLow |
|---|
CVE-2025-24357vLLM allows a malicious model RCE by torch.load in hf_model_weights_iterator | Exploitation statusNot exploited | FixYes | Published01/27/2025 | SeverityHigh |
|---|
121 Results | Page 3 of 3