Skip to content
Threat Feed
Subscribe

Vendor

VLLM

5 briefs RSS
medium advisory

Denial of Service Vulnerabilities in vLLM

Multiple vulnerabilities in the vLLM inference engine allow an unauthenticated attacker to trigger a denial of service, impacting the availability of LLM inference services.

vllm denial-of-service vulnerability ai-infrastructure
1t
low advisory

Denial of Service in vLLM Mooncake Connector via KV Cache Exhaustion

The vLLM Mooncake connector up to version 0.29.0 is susceptible to a denial-of-service attack where malicious completion requests exhaust GPU memory by orphaned KV cache blocks.

Mooncake connector
1t 1c
high advisory

Remote Code Execution in vLLM LlavaOnevision2 Processor Loader

A vulnerability in vLLM versions prior to 0.28.0 allows remote code execution by bypassing the trust_remote_code parameter during the loading of malicious LlavaOnevision2 processor classes.

vLLM +1 remote-code-execution model-inference supply-chain denial-of-service vulnerability inference-engine cve-2026-94624
1r 3t 1c updated
medium advisory

Denial of Service Vulnerability in vLLM

An authenticated remote attacker can exploit a vulnerability in vLLM to trigger a Denial of Service condition, likely through resource exhaustion.

vLLM denial-of-service cve-2024-53676 availability
1t 1c updated
low advisory

vLLM Denial of Service Vulnerability via M-RoPE Prompt Embeds (CVE-2026-55514)

A denial of service vulnerability, CVE-2026-55514, exists in vLLM versions from 0.12.0 up to, but not including, 0.24.0, allowing an authorized remote user to send a specially crafted `/v1/completions` request that leverages pure prompt embeds with an M-RoPE-enabled model to trigger an assertion failure, causing the vLLM server application to fatally crash.

vLLM denial-of-service large-language-model cve
1t 1c