Known Vulnerabilities for Vllm by Vllm-project
Listed below are 10 of the newest known vulnerabilities associated with "Vllm" by "Vllm-project".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-114055 json | vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to contr... | Not Provided | 2026-10-21 | 2026-10-21 |
| CVE-2026-114054 json | vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys b... | Not Provided | 2026-10-21 | 2026-10-21 |
| CVE-2026-114053 json | vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.f... | Not Provided | 2026-10-21 | 2026-10-21 |
| CVE-2026-114052 json | vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a proc... | Not Provided | 2026-10-21 | 2026-10-21 |
| CVE-2026-114051 json | vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so th... | Not Provided | 2026-10-21 | 2026-10-21 |
| CVE-2026-114050 json | vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits,... | Not Provided | 2026-10-21 | 2026-10-21 |
| CVE-2026-114049 json | vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain othe... | Not Provided | 2026-10-21 | 2026-10-21 |
| CVE-2026-109311 json | vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's... | Not Provided | 2026-10-12 | 2026-10-18 |
| CVE-2026-105922 json | A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mas... | Not Provided | 2026-10-06 | 2026-10-06 |
| CVE-2026-105775 json | A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of t... | Not Provided | 2026-10-06 | 2026-10-09 |