vLLM: vLLM has Remote DoS via Invalid Recovered Token Reinjection
Affects: vLLM
vLLM vulnerabilities
- Product
- vLLM
- Vendor
- vLLM project
- Kind
- Inference server
Securaity has published 67 advisories for vLLM: 1 Critical, 25 High, 40 Medium, 1 Low.
vLLM is an inference server, which is software that loads AI models and answers requests to them from other programs or users. It is made and maintained by the vLLM project, an open-source project. IT staff or developers typically install and run vLLM when their organization hosts AI models itself instead of using a vendor's cloud service. It runs on a server or computer that the organization itself controls.
Advisories
vLLM: Speech-to-text upload size limit is enforced after full UploadFile read
Affects: vLLM
vLLM: Incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
Affects: vLLM
vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels
Affects: vLLM
vLLM: OOM Denial of Service via Audio Decompression Bomb
Affects: vLLM
vLLM: Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the…
Affects: vLLM
vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving
Affects: vLLM
vLLM: OpenAI auth bypass
Affects: vLLM
vLLM: vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and…
Affects: vLLM
vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code…
Affects: vLLM
vLLM: VLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal…
Affects: vLLM
vLLM: VLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS)…
Affects: vLLM
vLLM: Image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input…
Affects: vLLM
vLLM: vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded…
Affects: vLLM
vLLM: vllm has Improper Resource Shutdown or Release
Affects: vLLM
vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters
Affects: vLLM
vLLM: vLLM Vulnerable to Remote DoS via Special-Token Placeholders
Affects: vLLM