CVE-2026-126394

vLLM 0.30.0 before 0.31.0 Resource Exhaustion via OpenPangu Video Backend num_frames

vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vulnerability in OpenCVDynamicOpenPanguVideoBackend, which uses request-controlled num_frames without an effective ceiling. Unauthenticated attackers can send /v1/chat/completions or /tokenize requests selecting the openpangu video_backend with a huge num_frames, forcing np.linspace allocations and CPU work that OOM-kill the API server.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Vllm

Products

Vllm

CVE-2026-126395

vLLM 0.14.0rc1 before 0.31.0 Heap Address Disclosure via sanitize_message()

vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose lowercase-only regex fails to scrub uppercase PIL image addresses. Unauthenticated attackers can send a crafted PNG to endpoints such as /tokenize, triggering HF-processor errors that leak live server heap addresses useful for ASLR bypass.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Vllm

Products

Vllm

CVE-2026-126396

vLLM from 0.24.0 before 0.31.0 Resource Exhaustion via MiniMax M3 min_pixels

vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level min_pixels without range or min_pixels <= max_pixels validation. Its video-wide pixel budget is enforced only when max_long_side_pixel is set, and that value defaults to None. API clients can supply a large min_pixels via mm_processor_kwargs to enlarge every decoded frame, causing excessive CPU and host-memory consumption that may disrupt workers or the service.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Vllm

Products

Vllm

CVE-2026-126397

vLLM 0.10.1 before 0.31.0 Cohere2 Vision DoS via max_patches

vLLM from 0.10.1 before 0.31.0 forwards a request-controlled mm_processor_kwargs.max_patches value to the Hugging Face processor for Cohere2 Vision models without a server-side upper bound, causing quadratic CPU work during multimodal preprocessing. Remote clients can send small image chat-completion requests with large, varying max_patches values to bypass the LRU cache, exhaust preprocessing workers, and deny service to other clients.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Vllm

Products

Vllm

CVE-2026-126398

vLLM 0.28.0 before 0.30.0 Denial of Service via Prompt Embeds on XD-RoPE Models

vLLM from 0.28.0 before 0.30.0 contains a reachable assertion vulnerability in GPUModelRunner._init_xdrope_positions that allows remote attackers to crash the engine by submitting embeddings-only requests. Attackers can send a /v1/completions request containing only prompt_embeds to XD-RoPE models with --enable-prompt-embeds, terminating the EngineCore and API server for all clients.

CVSS 4.0 · 8.2 High EPSS n/a KEV · Not listed

Vendors

Vllm

Products

Vllm

CVE-2026-126399

vLLM 0.19.0 before 0.31.0 Resource Exhaustion via Request-Level num_frames

vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the server frame limit by setting media_io_kwargs.video.num_frames in chat completion requests. Attackers can supply num_frames=-1 or a large value with many base64 JPEG frames, forcing VideoMediaIO to decode all frames and np.stack them, causing memory exhaustion.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed

Vendors

Vllm

Products

Vllm

CVE-2026-116176

vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-116172

vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via CandidateTokens.top_n. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping top_n values to trigger torch.topk failures that terminate EngineCore.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-115916

vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it, causing a CUDA device-side assertion and terminating the engine. This issue is fixed in version 0.32.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-115913

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forward_attention to materialize and retain full attention matrices in self.attn. The scaled dot-product attention branch does not materialize these matrices. The resulting quadratic GPU-memory use can cause an out-of-memory condition and terminate EngineCore for all users. This issue is fixed in version 0.32.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-115917

vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on localhost, an internal network, or a VPN, call endpoints including GET /v1/models and POST /v1/chat/completions, consume GPU resources, and read responses. Cookie-based cross-site request forgery does not apply because credentials are disabled by default, and deployments requiring bearer authentication are exposed only when the caller already has a usable token. This issue is fixed in version 0.32.0.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-115918

vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs

vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is configured. ChatParams.get_apply_chat_template_kwargs() preserves that value without enforcing trust_request_chat_template, so the request can bypass the intended trust policy and cause CPU or memory exhaustion through Jinja rendering. This issue is fixed in version 0.32.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-115914

vLLM DeepSeek-OCR image processing vulnerable to denial of service

vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image is alone in its per-step encoder batch. _parse_and_validate_image_input returns no embedding, embed_multimodal propagates that value, and sanity_check_mm_encoder_outputs triggers a fatal assertion that shuts down the engine for all users. This issue is fixed in version 0.32.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-115911

vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by tokenizer.apply_chat_template() without a wall-clock timeout, output-size limit, or iteration bound. Rendering runs in a ThreadPoolExecutor with one worker by default, so a nonterminating render can block /v1/responses and other chat-template users after the request ends, while an output-expanding render can exhaust server memory. Harmony models are not affected because they do not use this Jinja path. This issue is fixed in version 0.32.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-116181

vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids

vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or write outside the V2 runner's logits buffer.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-116177

vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker and deny service to co-tenants.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-116174

vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-114054

vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys

vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match cache_salt to a LoRA name to reuse first-block KV state.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-114051

vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate

vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-114049

vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycled batch slots apply their token allowlist to victims' unrestricted requests.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm