vllm@0.23.0

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input due to improper validation of the temperature parameter while sampling. An attacker can cause the inference worker to crash or exhibit undefined behavior by supplying non-finite float values such as NaN or Infinity, which bypass validation and propagate to GPU kernels.

A fix was pushed into the master branch but not yet published.

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) through the audio.py file. An attacker can cause excessive memory consumption by uploading a specially crafted compressed audio file that decompresses to a very large size, leading to resource exhaustion and potential service disruption.

A fix was pushed into the master branch but not yet published.

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the error handling process for certain API and WebSocket routes, where unsanitized exception messages containing sensitive memory addresses are returned in response bodies. An attacker can obtain internal memory address information by submitting malformed image data or triggering exceptions that cause object representations to be included in error messages.

Note: This issue remains due to an incomplete fix for CVE-2026-22778.

A fix was pushed into the master branch but not yet published.

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Incorrect Conversion between Numeric Types in the ggml_dequantize, ggml_mul_mat_vec_a8, ggml_mul_mat_a8, and ggml_moe_a8 functions when tensor dimensions are truncated due to an integer overflow. An attacker can access residual GPU memory contents from previous inference requests by supplying a specially crafted model file with tensor dimensions whose product exceeds the maximum value of a 32-bit integer.

Note: This is only exploitable if the deployment is multi-tenant and loads attacker-controlled GGUF model files.

A fix was pushed into the master branch but not yet published.

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Improper Resource Shutdown or Release via the OpenAI-compatible Serving Path component. An attacker can cause the service to become unavailable by sending specially crafted requests remotely.

There is no fixed version for vllm.

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Use of Uninitialized Resource via the has_mamba_layers function in the KV Block Handler. An attacker can cause unintended behavior by leaking data between sessions.

A fix was pushed into the master branch but not yet published.

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the download_bytes_from_url function. An attacker can cause the server to make arbitrary HTTP or HTTPS requests to internal or external resources by supplying a crafted file_url value in batch input JSON, potentially accessing sensitive internal services or causing denial of service.

A fix was pushed into the master branch but not yet published.

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the SUB ZeroMQ socket, where the deserialization is performed using the unsafe pickle library. An attacker on the same cluster can execute arbitrary code on the remote machine by sending maliciously crafted deserialized payloads.

Note The V0 engine is off by default since v0.8.0, and the V1 engine is not affected. Due to the V0 engine's deprecated status and the invasive nature of a fix, the developers recommend ensuring a secure network environment if the V0 engine with multi-host tensor parallelism is still in use.

There is no fixed version for vllm.