vLLM security advisories

Unvalidated stop_token_ids causes engine crash (DoS) and out-of-bounds GPU write

Remote DoS in vLLM via allowed_token_ids Speculative-Decoding Metadata Mismatch

Cross-tenant DoS via uninitialized LogprobsTensors with prompt_logprobs

Frame-count cap bypass in VideoMediaIO.load_base64 for video/jpeg via media_io_kwargs.video.num_frames

Remote DoS in disaggregated multimodal /inference/v1/generate via malicious kwargs_data / mm_placeholders

Nemotron-VL processors disable Pillow decompression-bomb guard globally, enabling unauthenticated DoS

SSRF via X-Request-Id header drives P2pNcclConnector outbound ZMQ+NCCL pair, leaking KV-cache tensors

Multimodal chat audio decoding bypasses the decompression-bomb duration limit

Rust gRPC Generate accepts out-of-vocabulary prompt token IDs and can terminate EngineCore

Rust gRPC output_candidates.token_ids bypasses logprob_token_ids limits and can terminate EngineCore

Rust gRPC CandidateTokens.top_n bypasses max_logprobs and can terminate EngineCore

DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)

Caller-controllable values become or collide with shared cache keys, enabling cross-request cache aliasing (2 sites: multimodal EXIF hash and prefix-cache extra keys)

Request-controlled mm_processor_kwargs.code_revision allows remote code execution

MOSS-Audio request-controlled processor cache permits remote memory exhaustion

An oversized min_tokens in one request hangs the vLLM engine while /health stays green

Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

V1 InputBatch.condense leaves a stale allowed_token_ids mask on recycled batch rows

Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

Crafted IAMF audio upload reaches a PyAV/FFmpeg native heap overflow through the speech transcription path — denial of service

Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

Scale-out disaggregated multimodal transport trusts caller-supplied features — shared EngineCore denial of service, encoder-cache poisoning, and transport integrity loss (5 sites)

Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

GLMGA video sampling permits request-driven CPU and memory exhaustion

Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)

Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

Out-of-range `stop_token_ids` with `min_tokens` can kill vLLM EngineCore

Incomplete artifact pin propagation in FunAudioChat and Tarsier2

Rust HTTP/gRPC stop_token_ids bypass Python vocab-bound fix and can terminate EngineCore

Disaggregated generate skips decoder prompt-length validation for some multimodal processors

Remote media is fetched and fully materialized before the documented media size / item limits are enforced — remote pre-inference memory and bandwidth exhaustion (4 sites)

Sampler Subclass Counter Shadowing Bypasses PyNvVideoCodec Decoder Limits and GPU Memory Accounting

Uncontrolled resource consumption: multimodal chat audio decoding ignores `VLLM_MAX_AUDIO_CLIP_FILESIZE_MB`

vLLM DoS via unbounded `cache_salt` length: multi-hundred-MB salt stalls the single EngineCore scheduler thread (CPU exhaustion)

Denial of service: a negative token id in `/v1/embeddings` or `/pooling` input kills the vLLM engine via a CUDA device-side assertion

Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

Speech-to-text audio decode duration limit bypass via forged header sample rate

Denial of Service NanoNemoTronVL Video Audio Extraction Bomb

LlavaOnevision2 processor loader executes attacker model code with `trust_remote_code=False` (inert `trust_remote_code` kwarg to `transformers.get_class_from_dynamic_module`) — RCE from a malicious model

Unauthenticated audio decompression-bomb DoS in /v1/chat/completions: VLLM_MAX_AUDIO_DECODE_DURATION_S guard not wired into the chat audio path (sibling of CVE-2026-5497)

SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

Cross-User Data Leak Vulnerability

vLLM Unauthenticated Requests Exploit DeepStream Backend Confusion for DoS

Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

Completion prompt lists fan out into unbounded engine requests

Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

Remote DoS in vLLM via Invalid Recovered Token Reinjection

DoS caused by sending `/v1/completions` with prompt embeds payload with models that use M-RoPE

Speech-to-text upload size limit is enforced after full UploadFile read

Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

vLLM image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

OOM Denial of Service via Audio Decompression Bomb

temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router (CWE-532)

Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors

Dependency Confusion Vulnerability in vLLM Dockerfile

OpenAI API Auth Bypass

extract_hidden_states speculative decoding crashes server on any request with penalty parameters

Remote DoS via Special-Token Placeholders

OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

Server-Side Request Forgery (SSRF) in `download_bytes_from_url `

Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing

Downmix Implementation Differences as Attack Vectors Against Audio AI Models

Hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out

SSRF Protection Bypass in vLLM

vLLM RCE In Video Processing

Server-Side Request Forgery (SSRF) in `MediaConnector`

DoS via incorrect shape of multimodal embedding inputs

RCE via auto_map dynamic module loading during model initialization

DoS in Idefics3 vision models via image payload with ambiguous dimensions

Missing validation of multimodal embeddings leading to DoS and potential RCE

Remote code execution via transformers_utils/get_config

DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`

prompt_embeds deserialization allows DoS and potential RCE

DoS with incorrect shape of multimodal embedding inputs

Server-Side Request Forgery (SSRF) in `MediaConnector`

Resource-Exhaustion (DoS) through chat_template / chat_template_kwargs in OpenAI-Compatible Server

API key authentication vulnerable to timing attack

HTTP header size limits not enforced, allowing DoS from unauthenticated requests

Remote code execution in the vllm tool call parser for Qwen3-Coder

Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching

DOS: Remotely kill vllm over http with invalid JSON schema

Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`

Weakness in MultiModalHasher Image/video Hashing Implementation in vLLM

clients can crash the openai server with invalid regex

A series of simple Redos in vllm.

DoS via Malformed pattern and type Fields in vLLM Tool Schema

Remote Code Execution via PyNcclPipe Communication Service

Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration

Denial of Service via ZeroMQ on Multi-node vLLM Deployment

Remote Code Execution via Mooncake Integration

phi4mm: Quadratic Time Complexity in Input Token Processing​ leads to denial of service

CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0

Denial of Service by abusing xgrammar cache

Remote Code Execution via Mooncake Integration

Denial of Service by abusing outlines unbounded cache on disk

vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cache

Malicious model to RCE by torch.load in hf_model_weights_iterator