9 matches found
SUSE CVE-2026-115917
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowedorigins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on...
CVE-2026-115917
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowedorigins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on...
PYSEC-2026-4348
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowedorigins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on...
CVE-2026-115917
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowedorigins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on...
PT-2026-132751
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on...
PT-2026-125027
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.32.0 Description The OpenAI-compatible server in this inference engine for large language models configures Starlette CORSMiddleware with allowed origins set to a wildcard by default. This allows a malicious web page t...
PYSEC-2026-2013 vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server
Summary A resource-exhaustion denial-of-service vulnerability exists in multiple endpoints of the OpenAI-Compatible Server due to the ability to specify Jinja templates via the chattemplate and chattemplatekwargs parameters. If an attacker can supply these parameters to the API, they can cause a...
GHSA-6FVQ-23CW-5628 vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server
Summary A resource-exhaustion denial-of-service vulnerability exists in multiple endpoints of the OpenAI-Compatible Server due to the ability to specify Jinja templates via the chattemplate and chattemplatekwargs parameters. If an attacker can supply these parameters to the API, they can cause a...
PT-2025-41232
Name of the Vulnerable Software and Affected Versions vLLM affected versions not specified Description A resource-exhaustion denial-of-service issue exists in multiple endpoints of the OpenAI-Compatible Server. The server allows users to specify Jinja templates through the chat template and chat...