Security: vllm-project/vllm
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Missing validation of multimodal embeddings leading to DoS and potential RCEGHSA-mcmc-2m55-j8jj published
Jan 8, 2026 by russellbHigh -
DoS in Idefics3 vision models via image payload with ambiguous dimensionsGHSA-grg2-63fw-f2qr published
Jan 9, 2026 by russellbModerate -
Remote code execution via transformers_utils/get_configGHSA-8fr4-5q9j-m8gm published
Dec 1, 2025 by russellbHigh -
DoS with incorrect shape of multimodal embedding inputsGHSA-pmqf-x6x8-p7qw published
Nov 20, 2025 by russellbModerate -
prompt_embeds deserialization allows DoS and potential RCEGHSA-mrw7-hf4f-83pf published
Nov 20, 2025 by russellbHigh -
DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`GHSA-69j4-grxj-j64p published
Nov 20, 2025 by russellbModerate -
API key authentication vulnerable to timing attackGHSA-wr9h-g72x-mwhm published
Oct 7, 2025 by russellbHigh -
Resource-Exhaustion (DoS) through chat_template / chat_template_kwargs in OpenAI-Compatible ServerGHSA-6fvq-23cw-5628 published
Oct 7, 2025 by russellbModerate -
Remote code execution in the vllm tool call parser for Qwen3-CoderGHSA-79j6-g2m3-jgfw published
Aug 20, 2025 by russellbHigh -
Server-Side Request Forgery (SSRF) in `MediaConnector`GHSA-3f6c-7fw2-ppm4 published
Oct 7, 2025 by russellbHigh