vllm
PyPI110 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting vllmpage 3 of 3
- CVE-2026-93592HIGHCVSS 7.5EG 7.5fixed in 0.28.02026-09-18
vulnerable: 0.0.1 ... 0.9.2 (95 versions)
vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negati…
- CVE-2026-93840MEDIUMCVSS 5.3EG 5.3fixed in 0.29.02026-09-18
vulnerable: 0.0.1 ... 0.9.2 (96 versions)
vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass validation, …
- CVE-2026-93841MEDIUMCVSS 5.3EG 5.3fixed in 0.30.02026-09-18
vulnerable: 0.0.1 ... 0.9.2 (97 versions)
vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal …
- CVE-2026-93989MEDIUMCVSS 4.3EG 4.3fixed in 0.30.02026-09-19
vulnerable: 0.0.1 ... 0.9.2 (97 versions)
vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of co…
- CVE-2026-94622HIGHCVSS 7.5EG 7.5fixed in 0.30.02026-09-21
vulnerable: 0.0.1 ... 0.9.2 (97 versions)
vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kv_transfer_params dictionary entrie…
- CVE-2026-94623HIGHCVSS 7.5EG 7.5fixed in 0.30.02026-09-21
vulnerable: 0.0.1 ... 0.9.2 (97 versions)
vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deplo…
- CVE-2026-94624MEDIUMCVSS 7.5EG 6.5fixed in 0.32.0 or 0.30.0, by version range2026-09-21
vulnerable: 0.0.1 ... 0.9.2 (97 versions)
vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can supply arbitrary remote host and port va…
- CVE-2026-94625MEDIUMCVSS 5.3EG 5.3fixed in 0.30.02026-09-21
vulnerable: 0.0.1 ... 0.9.2 (97 versions)
vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender t…
- CVE-2026-94626HIGHCVSS 7.5EG 7.5fixed in 0.30.02026-09-21
vulnerable: 0.0.1 ... 0.9.2 (97 versions)
vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode d…
- CVE-2026-9540MEDIUMCVSS 5.3EG 5.32026-05-26
vulnerable: 0.0.1 ... 0.9.2 (81 versions)
A vulnerability was identified in vllm-project vllm 0.19.0. This issue affects some unknown processing of the component OpenAI-compatible Serving Path. Such manipulation leads to denial of service. It is possible to launch the attack remot…
Check whether vllm is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for vllm CVEs against the assets you own.
Book a Demo →