Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*

3 briefs RSS
low advisory

vLLM Denial of Service via Unbounded Memory Allocation

An input validation flaw in vLLM version 0.29.0 and earlier allows remote attackers to cause a denial-of-service by submitting malicious parameters to OpenAI-compatible completion endpoints, triggering memory exhaustion.

vLLM denial-of-service input-validation ai-security
1t 1c
high advisory

Remote Code Execution in vLLM LlavaOnevision2 Processor Loader

A vulnerability in vLLM versions prior to 0.28.0 allows remote code execution by bypassing the trust_remote_code parameter during the loading of malicious LlavaOnevision2 processor classes.

vLLM +1 remote-code-execution model-inference supply-chain denial-of-service vulnerability inference-engine cve-2026-94624
1r 3t 1c updated
low advisory

vLLM Denial of Service Vulnerability via M-RoPE Prompt Embeds (CVE-2026-55514)

A denial of service vulnerability, CVE-2026-55514, exists in vLLM versions from 0.12.0 up to, but not including, 0.24.0, allowing an authorized remote user to send a specially crafted `/v1/completions` request that leverages pure prompt embeds with an M-RoPE-enabled model to trigger an assertion failure, causing the vLLM server application to fatally crash.

vLLM denial-of-service large-language-model cve
1t 1c