Skip to content
Threat Feed
Subscribe

Tag

VLLM

4 briefs RSS
low advisory

vLLM Denial of Service Vulnerability via M-RoPE Prompt Embeds (CVE-2026-55514)

A denial of service vulnerability, CVE-2026-55514, exists in vLLM versions from 0.12.0 up to, but not including, 0.24.0, allowing an authorized remote user to send a specially crafted `/v1/completions` request that leverages pure prompt embeds with an M-RoPE-enabled model to trigger an assertion failure, causing the vLLM server application to fatally crash.

vLLM denial-of-service large-language-model cve
1t 1c
critical advisory

vllm Vulnerability Allows Remote Code Execution

A remote, anonymous attacker can exploit a vulnerability in vllm to achieve arbitrary code execution.

vllm remote-code-execution vulnerability
2r 1t
high advisory

vllm and PyTorch Vulnerability Allows DoS and Potential Remote Code Execution

A remote, authenticated attacker can exploit a vulnerability in vllm and PyTorch to cause a denial-of-service condition or potentially achieve remote code execution.

vllm denial-of-service remote-code-execution PyTorch
2r 2t
critical advisory

vLLM Remote Code Execution Vulnerability (CVE-2026-27893)

vLLM versions before 0.18.0 are vulnerable to remote code execution due to hardcoded trust of remote code, even when explicitly disabled by the user, allowing attackers to execute arbitrary code via malicious model repositories.

vLLM RCE CVE-2026-27893
2r 1t