{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "vllm-project vllm: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/vllm-project--vllm/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/vllm-project--vllm/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-116180/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-116180/",
   "title": "CVE-2026-116180 disclosed",
   "content_text": "vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests.",
   "date_published": "2026-10-25T13:20:19Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-116179/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-116179/",
   "title": "CVE-2026-116179 disclosed",
   "content_text": "vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so VideoMediaIO.load_base64 decodes every frame, exhausting memory and crashing the API frontend.",
   "date_published": "2026-10-25T13:20:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-116177/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-116177/",
   "title": "CVE-2026-116177 disclosed",
   "content_text": "vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker and deny service to co-tenants.",
   "date_published": "2026-10-25T13:20:17Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-116176/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-116176/",
   "title": "CVE-2026-116176 disclosed",
   "content_text": "vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.",
   "date_published": "2026-10-25T13:20:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114055/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114055/",
   "title": "CVE-2026-114055 disclosed",
   "content_text": "vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server.",
   "date_published": "2026-10-21T00:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114055/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114055/",
   "title": "CVE-2026-114055 fixed upstream (PyPI)",
   "content_text": "Fixed versions: vllm 0.31.0.",
   "date_published": "2026-10-21T00:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114053/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114053/",
   "title": "CVE-2026-114053 disclosed",
   "content_text": "vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.",
   "date_published": "2026-10-21T00:36:29Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114052/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114052/",
   "title": "CVE-2026-114052 disclosed",
   "content_text": "vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.",
   "date_published": "2026-10-21T00:36:29Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114051/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114051/",
   "title": "CVE-2026-114051 disclosed",
   "content_text": "vLLM before 0.31.0 skips the min_tokens \u003c= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.",
   "date_published": "2026-10-21T00:36:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114050/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114050/",
   "title": "CVE-2026-114050 disclosed",
   "content_text": "vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.",
   "date_published": "2026-10-21T00:36:27Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114050/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114050/",
   "title": "CVE-2026-114050 fixed upstream (PyPI)",
   "content_text": "Fixed versions: vllm 0.31.0.",
   "date_published": "2026-10-21T00:36:27Z"
  }
 ]
}