vLLM

vLLM affected by RCE via auto_map dynamic module loading during model initialization

vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class

vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching

vLLM has RCE In Video Processing

vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`

vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models

vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server

vLLM: OOM Denial of Service via Audio Decompression Bomb

vLLM DOS: Remotely kill vllm over http with invalid JSON schema

vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

vLLM vulnerable to remote code execution via transformers_utils/get_config

vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

vLLM: OpenAI auth bypass

vllm has Improper Resource Shutdown or Release

vLLM allows clients to crash the openai server with invalid regex

Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration

vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

vLLM Vulnerable to Remote DoS via Special-Token Placeholders

vLLM vulnerable to Regular Expression Denial of Service

vLLM introduced enhanced protection for CVE-2025-62164

vLLM deserialization vulnerability leading to DoS and potential RCE

vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs

vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing

vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector

vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

vllm API endpoints vulnerable to Denial of Service Attacks

vLLM Tool Schema allows DoS via Malformed pattern and type Fields

vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`

vLLM is vulnerable to timing attack at bearer auth

vLLM makes Use of Uninitialized Resource

Not reported

Not reported