The vulnerability of the v1/completions interface of the LLM vLLM library allows a attacker to trigger a service failure.

The vulnerability of the v1/completions interface of the LLM library for working with large language models is related to an error in handling exceptional states. Exploiting this vulnerability could allow a malicious actor to cause service failures...

GHSA-79J6-G2M3-JGFW vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9...

CVE-2025-9141 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9...

CVE-2025-48956 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9...

GHSA-5CMR-4PX5-23PC vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm...

GHSA-RXC4-3W6R-4V47 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to an HTTP GET request with an extremely large header being sent. An attacker can exhaust...

GHSA-79J6-G2M3-JGFW vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder

Summary An unsafe deserialization vulnerability allows any authenticated user to execute arbitrary code on the server if they are able to get the model to pass the code as an argument to a tool call. Details vLLM's Qwen3 Coder tool parser contains a code execution path that uses Python's eval...

CVE-2025-48956 vLLM API endpoints vulnerable to Denial of Service Attacks

vLLM is an inference and serving engine for large language models LLMs. From 0.1.0 to before 0.10.1.1, a Denial of Service DoS vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory exhaustion,...

CVE-2025-48956 vLLM API endpoints vulnerable to Denial of Service Attacks

vLLM is an inference and serving engine for large language models LLMs. From 0.1.0 to before 0.10.1.1, a Denial of Service DoS vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory exhaustion,...

CVE-2025-48956 vLLM API endpoints vulnerable to Denial of Service Attacks

vLLM is an inference and serving engine for large language models LLMs. From 0.1.0 to before 0.10.1.1, a Denial of Service DoS vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory exhaustion,...

GHSA-RXC4-3W6R-4V47 vllm API endpoints vulnerable to Denial of Service Attacks

Summary A Denial of Service DoS vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory exhaustion, potentially leading to a crash or unresponsiveness. The attack does not require authentication, making ...

PT-2025-34260

Name of the Vulnerable Software and Affected Versions: vLLM affected versions not specified Description: An unsafe deserialization allows any authenticated user to execute arbitrary code on the server if they are able to get the model to pass the code as an argument to a tool call. The issue...

vLLM 资源管理错误漏洞

vLLM is a high throughput and memory efficient inference and service engine for LLM from the vLLM open source. A resource management error vulnerability exists in vLLM versions prior to 0.1.0 through 0.10.1.1, which stems from the fact that sending an HTTP GET request with a very large header cou...

CVE-2025-48956: Uncontrolled Resource Consumption

vLLM is an inference and serving engine for large language models LLMs. From 0.1.0 to before 0.10.1.1, a Denial of Service DoS vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory exhaustion,...

CVE-2025-9141

A vulnerability was found in vLLM's Qwen3 Coder tool parser. Since this parser uses Python's eval function, it poses a risk of arbitrary code execution. This vulnerability appears during the parameter conversion process when the parser attempts to handle complex data types...

CVE-2024-47081 vulnerabilities

Vulnerabilities for packages: nemo, openstack-kolla-toolbox-2025.1-fips, dask-gateway, py3-requests, jupyter-docker-stacks, py3-pipenv, airflow-core, reflex, superset, jwt-tool, emissary, k8s-sidecar, jupyter-base-notebook, kubeflow-katib, openstack-kolla-toolbox-2025.1, nvidia-nsight-compute-13....

GHSA-9PCC-GVX5-R5WM vulnerabilities

Vulnerabilities for packages: py3.10-vllm-cuda-12.6...

CVE-2025-30165 vulnerabilities

Vulnerabilities for packages: py3.10-vllm-cuda-12.6...

GHSA-9HJG-9R4M-MVJ7 vulnerabilities

Vulnerabilities for packages: nemo, openstack-kolla-toolbox-2025.1-fips, dask-gateway, py3-requests, jupyter-docker-stacks, py3-pipenv, airflow-core, reflex, superset, jwt-tool, emissary, k8s-sidecar, jupyter-base-notebook, kubeflow-katib, openstack-kolla-toolbox-2025.1, nvidia-nsight-compute-13....