vllm

Vulnerabilities (45)

• CVE-2025-62164HigNov 21, 2025
  affected >= 0.10.2, < 0.11.1fixed 0.11.1

  vLLM is an inference and serving engine for large language models (LLMs). From versions 0.10.2 to before 0.11.1, a memory corruption vulnerability could lead to a crash (denial-of-service) and potentially remote code execution (RCE), exists in the Completions API endpoint. When p

• CVE-2025-61620medOct 7, 2025
  affected >= 0.5.1, < 0.11.0fixed 0.11.0

  ### Summary A resource-exhaustion (denial-of-service) vulnerability exists in multiple endpoints of the OpenAI-Compatible Server due to the ability to specify Jinja templates via the `chat_template` and `chat_template_kwargs` parameters. If an attacker can supply these parameter

• CVE-2025-6242HigOct 7, 2025
  affected >= 0.5.0, < 0.11.0fixed 0.11.0

  A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on the target ho

• CVE-2025-59425HigOct 7, 2025
  affected < 0.11.0fixed 0.11.0

  vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support in vLLM performs validation using a method that was vulnerable to a timing attack. API key validation uses a string comparison that takes longer the more charac

• CVE-2025-48956HigAug 21, 2025
  affected >= 0.1.0, < 0.10.1.1fixed 0.10.1.1

  vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.10.1.1, a Denial of Service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory

• CVE-2025-9141higAug 21, 2025
  affected >= 0.10.0, < 0.10.1.1fixed 0.10.1.1

  ### Summary An unsafe deserialization vulnerability allows any authenticated user to execute arbitrary code on the server if they are able to get the model to pass the code as an argument to a tool call. ### Details vLLM's [Qwen3 Coder tool parser](https://github.com/vllm-proje

• CVE-2025-48944MedMay 30, 2025
  affected >= 0.8.0, < 0.9.0fixed 0.9.0

  vLLM is an inference and serving engine for large language models (LLMs). In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the "pattern" and "type" fields when the t

• CVE-2025-48943MedMay 30, 2025
  affected >= 0.8.0, < 0.9.0fixed 0.9.0

  vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to

• CVE-2025-48942MedMay 30, 2025
  affected >= 0.8.0, < 0.9.0fixed 0.9.0

  vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid json_schema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-4

• CVE-2025-48887MedMay 30, 2025
  affected >= 0.6.4, < 0.9.0fixed 0.9.0

  vLLM, an inference and serving engine for large language models (LLMs), has a Regular Expression Denial of Service (ReDoS) vulnerability in the file `vllm/entrypoints/openai/tool_parsers/pythonic_tool_parser.py` of versions 0.6.4 up to but excluding 0.9.0. The root cause is the u

• CVE-2025-46722MedMay 29, 2025
  affected >= 0.7.0, < 0.9.0fixed 0.9.0

  vLLM is an inference and serving engine for large language models (LLMs). In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializ

• CVE-2025-46570LowMay 29, 2025
  affected < 0.9.0fixed 0.9.0

  vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT (Time to First Token). The

• CVE-2025-47277CriMay 20, 2025
  affected >= 0.6.5, < 0.8.5fixed 0.8.5

  vLLM, an inference and serving engine for large language models (LLMs), has an issue in versions 0.6.5 through 0.8.4 that ONLY impacts environments using the `PyNcclPipe` KV cache transfer integration with the V0 engine. No other configurations are affected. vLLM supports the use

• CVE-2025-30165HigMay 6, 2025
  affected >= 0.5.2, < 0.10.0fixed 0.10.0

  vLLM is an inference and serving engine for large language models. In a multi-node vLLM deployment using the V0 engine, vLLM uses ZeroMQ for some multi-node communication purposes. The secondary vLLM hosts open a `SUB` ZeroMQ socket and connect to an `XPUB` socket on the primary

• CVE-2025-46560MedApr 30, 2025
  affected >= 0.8.0, < 0.8.5fixed 0.8.5

  vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.8.0 and prior to 0.8.5 are affected by a critical performance vulnerability in the input preprocessing logic of the multimodal tokenizer. The code dynamically replaces p

• CVE-2025-32444CriApr 30, 2025
  affected >= 0.6.5, < 0.8.5fixed 0.8.5

  vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration with mooncake, are vulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sock

• CVE-2025-30202HigApr 30, 2025
  affected >= 0.5.2, < 0.8.5fixed 0.8.5

  vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vulnerable to denial of service and data exposure via ZeroMQ on multi-node vLLM deployment. In a multi-node vLLM deployment, vLLM uses ZeroMQ

• CVE-2024-9053CriMar 20, 2025
  affected <= 0.6.0

  vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls the function _make_handler_coro(), which directly uses cloudpickle.loads() on received messages without any sanitization.

• CVE-2024-11041CriMar 20, 2025
  affected <= 0.6.2

  vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a malicious payload t

• CVE-2025-29783CriMar 19, 2025
  affected >= 0.6.5, < 0.8.0fixed 0.8.0

  vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is