vLLM

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

vLLM affected by RCE via auto_map dynamic module loading during model initialization

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class

vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching

vLLM has RCE In Video Processing

vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`

vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models

vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server

vLLM: OOM Denial of Service via Audio Decompression Bomb

vLLM DOS: Remotely kill vllm over http with invalid JSON schema

vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

vLLM: Cross-User Data Leak Vulnerability

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

vLLM vulnerable to remote code execution via transformers_utils/get_config

vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

vLLM: OpenAI auth bypass

vllm has Improper Resource Shutdown or Release

vLLM allows clients to crash the openai server with invalid regex

Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration

vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

vllm p2p never connected zmq_exhaustion

vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions

vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)

vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

vLLM Vulnerable to Remote DoS via Special-Token Placeholders

vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

vLLM vulnerable to Regular Expression Denial of Service

vLLM introduced enhanced protection for CVE-2025-62164

vLLM deserialization vulnerability leading to DoS and potential RCE

vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs