VLLM: Eight Vulnerabilities Disclosed Together, Patch Released in 0.29.0

Key findings

• Eight vulnerabilities in VLLM disclosed on September 26, 2026, patched in version 0.29.0.
• Multiple vulnerabilities related to improper validation of stop_token_ids and resource limits in multimodal handling.
• Denial-of-service risks identified in cache_salt processing and oversized audio file handling.
• Potential for CUDA errors and incorrect model component loading due to input validation flaws.
• Users are urged to update to VLLM 0.29.0 to address these security concerns.

On September 26, 2026, a batch of eight vulnerabilities was disclosed for the VLLM large language model inference and serving engine. These vulnerabilities, ranging in severity from Low to Medium, were all patched in version 0.29.0. The disclosures highlight several areas of concern, including improper validation of user-supplied inputs, resource limit bypasses, and potential denial-of-service vectors.

Several of the vulnerabilities stem from insufficient validation of stop_token_ids. CVE-2026-100654 and CVE-2026-100652 describe how VLLM versions prior to 0.29.0 accept user-controlled stop_token_ids on completion endpoints. While some versions validate that the values are integers, they fail to ensure these token IDs are within the model's vocabulary or logits range. This could lead to CUDA tensorial errors when min_tokens is greater than zero.

Another theme among the disclosed vulnerabilities relates to the handling of multimodal inputs and associated resource limits. CVE-2026-100650 and CVE-2026-100648 point out that VLLM versions before 0.29.0 fetch and materialize remote or inline media before enforcing documented media controls. Specifically, the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit and per-modality item limits can be bypassed, allowing oversized audio files to be processed, consuming excessive memory and CPU resources during decoding. CVE-2026-100651 addresses a failure to enforce decoder prompt-length validation on the disaggregated serving endpoint when a multimodal payload is present.

Further issues include a resource-limit bypass in the PyNvVideoCodec decoder allocation (CVE-2026-100649), where sampler subclass shadowing allows for independent counter increments, potentially exhausting unaccounted GPU memory. Additionally, CVE-2026-100653 notes that the operator-supplied model revision pin is not consistently propagated to all necessary Hugging Face artifact loads for certain architectures, potentially leading to the use of incorrect model components.

Finally, CVE-2026-100647 describes a denial-of-service vulnerability in the cache_salt parameter accepted on API endpoints. This parameter lacks maximum length validation and is processed on a single scheduler thread, allowing attackers to send requests with excessively long cache_salt values to consume significant resources.

All eight vulnerabilities have been addressed in VLLM version 0.29.0. Users are strongly advised to update to this version to mitigate the identified risks, which include potential denial-of-service conditions and improper handling of sensitive model inputs. The consistent patching across these diverse issues in a single release underscores the importance of timely updates for maintaining the security and stability of LLM deployments.