vllm 0.19.1

Direct Vulnerabilities

Known vulnerabilities in the vllm package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Incorrect Type Conversion or Cast vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Incorrect Type Conversion or Cast through the `extract_hidden_states` speculative decoding. An attacker can cause the server to crash and disrupt service availability by submitting a request containing penalty parameters such as `repetition_penalty`, `frequency_penalty`, or `presence_penalty`. Note: This is only exploitable if the speculative decoding method is set to `extract_hidden_states`. How to fix Incorrect Type Conversion or Cast? Upgrade `vllm` to version 0.20.0 or higher.	[0.18.0,0.20.0)
H Improper Validation of Array Index vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Validation of Array Index via the `get_input_positions_tensor` function. An attacker can cause the service to terminate or become unavailable by sending specially crafted requests containing placeholder tokens for images or videos without supplying the corresponding data, which leads to an unhandled exception during input position computation. How to fix Improper Validation of Array Index? Upgrade `vllm` to version 0.20.0 or higher.	[0.6.1,0.20.0)
M Use of Uninitialized Resource vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Use of Uninitialized Resource via the `has_mamba_layers` function in the KV Block Handler. An attacker can cause unintended behavior by leaking data between sessions. How to fix Use of Uninitialized Resource? A fix was pushed into the `master` branch but not yet published.	[0,)
M Server-side Request Forgery (SSRF) vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the `download_bytes_from_url` function. An attacker can cause the server to make arbitrary HTTP or HTTPS requests to internal or external resources by supplying a crafted `file_url` value in batch input JSON, potentially accessing sensitive internal services or causing denial of service. How to fix Server-side Request Forgery (SSRF)? A fix was pushed into the `master` branch but not yet published.	[0.16.0,)
H Deserialization of Untrusted Data vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the `SUB` ZeroMQ socket, where the deserialization is performed using the unsafe `pickle` library. An attacker on the same cluster can execute arbitrary code on the remote machine by sending maliciously crafted deserialized payloads. Note The V0 engine is off by default since v0.8.0, and the V1 engine is not affected. Due to the V0 engine's deprecated status and the invasive nature of a fix, the developers recommend ensuring a secure network environment if the V0 engine with multi-host tensor parallelism is still in use. How to fix Deserialization of Untrusted Data? There is no fixed version for `vllm`.	[0.5.2,)
H Deserialization of Untrusted Data vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the `MessageQueue.dequeue()` API function. An attacker can execute arbitrary code by sending a malicious payload to the message queue. How to fix Deserialization of Untrusted Data? There is no fixed version for `vllm`.	[0,)

Vulnerability

Vulnerable Version

Incorrect Type Conversion or Cast

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Incorrect Type Conversion or Cast through the extract_hidden_states speculative decoding. An attacker can cause the server to crash and disrupt service availability by submitting a request containing penalty parameters such as repetition_penalty, frequency_penalty, or presence_penalty.

Note: This is only exploitable if the speculative decoding method is set to extract_hidden_states.

How to fix Incorrect Type Conversion or Cast?

Upgrade vllm to version 0.20.0 or higher.

[0.18.0,0.20.0)

Improper Validation of Array Index

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Improper Validation of Array Index via the get_input_positions_tensor function. An attacker can cause the service to terminate or become unavailable by sending specially crafted requests containing placeholder tokens for images or videos without supplying the corresponding data, which leads to an unhandled exception during input position computation.

How to fix Improper Validation of Array Index?

Upgrade vllm to version 0.20.0 or higher.

[0.6.1,0.20.0)

Use of Uninitialized Resource

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Use of Uninitialized Resource via the has_mamba_layers function in the KV Block Handler. An attacker can cause unintended behavior by leaking data between sessions.

How to fix Use of Uninitialized Resource?

A fix was pushed into the master branch but not yet published.

[0,)

Server-side Request Forgery (SSRF)

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the download_bytes_from_url function. An attacker can cause the server to make arbitrary HTTP or HTTPS requests to internal or external resources by supplying a crafted file_url value in batch input JSON, potentially accessing sensitive internal services or causing denial of service.

How to fix Server-side Request Forgery (SSRF)?

A fix was pushed into the master branch but not yet published.

[0.16.0,)

Deserialization of Untrusted Data

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the SUB ZeroMQ socket, where the deserialization is performed using the unsafe pickle library. An attacker on the same cluster can execute arbitrary code on the remote machine by sending maliciously crafted deserialized payloads.

Note The V0 engine is off by default since v0.8.0, and the V1 engine is not affected. Due to the V0 engine's deprecated status and the invasive nature of a fix, the developers recommend ensuring a secure network environment if the V0 engine with multi-host tensor parallelism is still in use.

How to fix Deserialization of Untrusted Data?

There is no fixed version for vllm.

[0.5.2,)

Deserialization of Untrusted Data

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the MessageQueue.dequeue() API function. An attacker can execute arbitrary code by sending a malicious payload to the message queue.

How to fix Deserialization of Untrusted Data?

There is no fixed version for vllm.

[0,)

vllm@0.19.1

A high-throughput and memory-efficient inference and serving engine for LLMs

latest version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically