VLLM: Batch of 17 Vulnerabilities Disclosed, Affecting LLM Inference Engine Stability
Seventeen vulnerabilities disclosed for VLLM between September 14-21, 2026, expose the LLM inference engine to denial of service, memory exhaustion, and data corruption risks.
Key findings
- Multiple high-severity vulnerabilities in VLLM versions prior to 0.29.0 lead to denial of service and GPU memory exhaustion.
- Flaws in KV cache management, parameter validation, and resource cleanup are recurring themes across several CVEs.
- Issues affecting media handling (video/audio decoding) and token processing present additional security risks.
- A critical vulnerability (CVE-2026-93592) allows unauthenticated attackers to crash the engine via negative token IDs.
- Users are urged to update VLLM to a patched version to address these widespread security concerns.
- The vulnerabilities span a range of severities, from low to high, impacting various components of the VLLM engine.
On September 21, 2026, a significant batch of 17 vulnerabilities was disclosed for the VLLM large language model inference engine, spanning a disclosure window from September 14 to September 21. These vulnerabilities, primarily affecting versions prior to 0.29.0, expose users to various risks including denial of service, memory exhaustion, and data corruption. The disclosures highlight critical issues in VLLM's handling of GPU KV cache, parameter validation, and resource management, potentially impacting the stability and security of LLM deployments.
Several high-severity vulnerabilities center on memory management and denial of service. CVE-2026-94627 and CVE-2026-94625 detail issues with GPU KV cache block ownership and resource reclamation in the Mooncake connector, which can lead to memory exhaustion or delayed request processing. CVE-2026-94624 describes a denial of service vulnerability in P2P KV offloading, allowing attackers to create unreachable peer sessions that retain resources. Additionally, CVE-2026-94623 and CVE-2026-94622 point to denial of service flaws in the NIXL connector's prefix caching and metadata handling, respectively, which can lead to assertion failures or uncaught exceptions. CVE-2026-93592, a high-severity flaw, allows unauthenticated attackers to crash the engine by submitting negative token IDs to the embeddings and pooling endpoints. CVE-2026-93436 also contributes to denial of service by allowing attackers to exhaust decode-worker memory with requests setting max_tokens=0.
Other vulnerabilities, while rated medium or low, also pose risks. CVE-2026-93989, CVE-2026-93840, and CVE-2026-93841 involve improper validation of token indices and parameters within sampling and Triton kernels, potentially corrupting logits memory or causing out-of-bounds writes. CVE-2026-69147 and CVE-2026-57173 highlight issues with media handling, specifically concerning video and audio decoding, which could be exploited to affect processing or lead to resource exhaustion. CVE-2026-92365 and CVE-2026-90878 point to vulnerabilities in specific file functionalities related to algorithmic complexity and Jinja template rendering, respectively, leading to resource consumption. CVE-2026-92220 involves a flaw in the MoRIIO connector's handling of finished requests. Finally, CVE-2026-90713, a low-severity issue, relates to a denial of service vulnerability in the tiktoken vocab file handler, requiring local access.
The majority of these vulnerabilities are addressed in VLLM versions prior to 0.29.0, with specific fixes mentioned for versions before 0.28.0 and 0.24.0 in some cases. Users are strongly advised to update to a patched version to mitigate these risks. The broad range of issues, from critical denial-of-service vectors to subtle data corruption, underscores the importance of maintaining up-to-date VLLM deployments, especially for organizations handling sensitive data or requiring high availability.
This batch of disclosures serves as a critical reminder for VLLM users to proactively manage their software versions and stay informed about security updates to protect against potential exploitation. The interconnected nature of these flaws, often stemming from improper input validation and resource management, highlights the need for thorough security auditing in complex LLM inference engines.
Key findings from this disclosure batch include:
- Multiple high-severity vulnerabilities in VLLM versions prior to 0.29.0 lead to denial of service and GPU memory exhaustion.
- Flaws in KV cache management, parameter validation, and resource cleanup are recurring themes across several CVEs.
- Issues affecting media handling (video/audio decoding) and token processing present additional security risks.
- A critical vulnerability (CVE-2026-93592) allows unauthenticated attackers to crash the engine via negative token IDs.
- Users are urged to update VLLM to a patched version to address these widespread security concerns.
- The vulnerabilities span a range of severities, from low to high, impacting various components of the VLLM engine.