vllm has 62 CVEs on record between 2024 and 2026. Disclosures have slowed: 11 in the last 90 days after 19 in the 90 before. The busiest recent month was June 2026 with 11. The median CVSS is 6.5 (medium), with 9 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-770 (5) and CWE-400 (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 11 prev 19
Weakness classes
Products
- vllm 62
Worst active — by depth score
CVE-2026-22778Critical· 9.8vLLM is an inference and serving engine for large language models (LLMs)67CVE-2026-48746Critical· 9.1vLLM is an inference and serving engine for large language models (LLMs)62CVE-2026-22807High· 8.8vLLM is an inference and serving engine for large language models (LLMs)61CVE-2025-32444Critical· 10.0vLLM Vulnerable to Remote Code Execution via Mooncake Integration55CVE-2025-47277Critical· 9.8vLLM Allows Remote Code Execution via PyNcclPipe Communication Service54
vllm vulnerabilities
CVEs affecting vllm, newest first. Open any entry for full detail, references, and exploit status.
62 CVEsRSS
CVE-2026-90555Medium· 6.5vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigge…
CVE-2026-90553High· 7.8vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes
vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbi…
CVE-2026-73560Medium· 6.5vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch…
CVE-2026-71486Medium· 4.3vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generate_responses, choice…
CVE-2026-73558Medium· 5.3vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a reque…
CVE-2026-73555Medium· 5.3vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_m…
CVE-2026-73556Medium· 5.3⚖ disputedvLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compi…
CVE-2026-73557MediumvLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse.check_sparse_tensor_invariants, whose process-global save, enable,…
CVE-2026-73559Medium· 6.5vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded list[str] or list[list…
CVE-2026-55514High· 6.5vLLM denial of service via prompt embeds on M-RoPE models
vLLM denial of service via prompt embeds on M-RoPE models
CVE-2026-55646Medium· 6.5vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/tran…
vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/translations routes call request.file.read() to fully materialize an uploaded audio file into memory bef…
CVE-2026-48746Critical· 9.1PoCvLLM is an inference and serving engine for large language models (LLMs)
vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API Authenti…
CVE-2026-56340High· 8.8vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing
vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with mal…
GHSA-78fp-cf4h-g36pHigh· 8.8Duplicate Advisory: vLLM introduced enhanced protection for CVE-2025-62164
Duplicate Advisory: vLLM introduced enhanced protection for CVE-2025-62164
GHSA-vfm7-4h43-gp6mMedium· 4.3Duplicate Advisory: vLLM Vulnerable to Regular Expression Denial of Service
Duplicate Advisory: vLLM Vulnerable to Regular Expression Denial of Service
CVE-2026-54235Medium· 6.5vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels
vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels
CVE-2026-12491Medium· 4.8vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
CVE-2026-53923High· 7.5vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving
vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving
CVE-2026-54236Medium· 5.3PoCvLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
CVE-2026-54233Medium· 6.5vLLM: OOM Denial of Service via Audio Decompression Bomb
vLLM: OOM Denial of Service via Audio Decompression Bomb
GHSA-x8xr-mj9x-6h7wMedium· 4.8Duplicate Advisory: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
Duplicate Advisory: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
CVE-2026-5497High· 7.5vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method
vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processing `video/jpeg` data URLs, the method …
CVE-2026-9540Medium· 5.3vllm has Improper Resource Shutdown or Release
vllm has Improper Resource Shutdown or Release
CVE-2026-44222Medium· 6.5vLLM Vulnerable to Remote DoS via Special-Token Placeholders
vLLM Vulnerable to Remote DoS via Special-Token Placeholders
CVE-2026-7141Medium· 5.6vLLM makes Use of Uninitialized Resource
vLLM makes Use of Uninitialized Resource
CVE-2026-34756Medium· 6.5vLLM is an inference and serving engine for large language models (LLMs)
vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the…
CVE-2026-34755Medium· 6.5vLLM is an inference and serving engine for large language models (LLMs)
vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19.0, the VideoMediaIO.load_base64() method at vllm/multimodal/media/video.py splits video/jpeg data URLs by comma to extract individual JPE…
CVE-2026-34753Medium· 5.4PoCvLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `
vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `
CVE-2026-34760High· 7.1vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa defaults t…
vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa defaults to using numpy.mean for mono downmixing (to_mono), while the international standard ITU-R BS.775-4 sp…
CVE-2026-27893High· 8.8vLLM is an inference and serving engine for large language models (LLMs)
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the…