vLLM vulnerabilities
We track 5 vulnerabilities in vLLM products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on August 28, 2026.
Latest vLLM vulnerabilities
- 7.5 High severity
Vllm: Uncontrolled Resource Consumption
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read
- 7.5 High severity
vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal…
vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed (negative or out
- 7.5 High severity
vllm: Inefficient Regular Expression Complexity
vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to cat
- 7.5 High severity
vllm-project/vllm: Uncontrolled Resource Consumption
vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processing `video/jpeg` data URLs, the method splits the base64 data
- 9.8 Critical severity
vllm-project/vllm: Deserialization of Untrusted Data
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a