PT-2026-35459

A vulnerability was found in vllm up to 0.19.0. The affected element is the function has mamba layers of the file vllm/v1/kv cache interface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource. It is possible to initiate the attack remotely. The attac...

CVE-2026-1839 vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-12.9, text-generation-inference, nemo, tritonserver-backend-vllm-cuda-13.0, lmcache-cuda-12.8, tritonserver-backend-vllm-cuda-12.9, py3-transformers...

GHSA-69W3-R845-3855 vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-12.9, text-generation-inference, nemo, tritonserver-backend-vllm-cuda-13.0, lmcache-cuda-12.8, tritonserver-backend-vllm-cuda-12.9, py3-transformers...

CVE-2026-40192 vulnerabilities

Vulnerabilities for packages: litellm, open-webui, text-generation-inference, py3-vllm-cuda-12.4, kubeflow-pipelines-visualization-server, superset, tritonserver-backend-vllm-cuda-12.9...

GHSA-WHJ4-6X5X-4V2J vulnerabilities

Vulnerabilities for packages: litellm, open-webui, text-generation-inference, py3-vllm-cuda-12.4, kubeflow-pipelines-visualization-server, superset, tritonserver-backend-vllm-cuda-12.9...

GHSA-PF3H-QJGV-VCPR vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, vllm-openai-cuda-12.9...

GHSA-3MWP-WVH9-7528 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

GHSA-PQ5C-RJHQ-QP7P vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

CVE-2026-34755 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

CVE-2026-34753 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, vllm-openai-cuda-12.9...

CVE-2026-34756 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

GHSA-P423-J2CM-9VMQ vulnerabilities

Vulnerabilities for packages: airflow-core, datadog-agent, k8s-sidecar, apache-beam-python-3.12-sdk, kubeflow-pipelines-visualization-server, datadog-agent-fips, ggshield, prefect, in-toto, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, dagster, label-studio, wazuh-manager,...

CVE-2026-39892 vulnerabilities

Vulnerabilities for packages: airflow-core, datadog-agent, k8s-sidecar, apache-beam-python-3.12-sdk, kubeflow-pipelines-visualization-server, datadog-agent-fips, ggshield, prefect, in-toto, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, dagster, label-studio, wazuh-manager,...

CVE-2026-34756

A flaw was found in vLLM, an inference and serving engine for large language models LLMs. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large 'n' parameter to the vLLM OpenAI-compatible API server. This can lead to a...

CVE-2026-34753

A flaw was found in vLLM. This server-side request forgery SSRF vulnerability allows an attacker who can control batch input JSON to force the vLLM batch runner to make arbitrary HTTP/HTTPS requests from the server. This can be exploited to access internal services, such as cloud metadata endpoin...

CVE-2026-34756

vLLM is an inference and serving engine for large language models LLMs. From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the n parameter in the ChatCompletionRequest and CompletionReques...

CVE-2026-34756

vLLM is an inference and serving engine for large language models LLMs. From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the n parameter in the ChatCompletionRequest and CompletionReques...

CVE-2026-34756 vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

vLLM is an inference and serving engine for large language models LLMs. From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the n parameter in the ChatCompletionRequest and CompletionReques...

CVE-2026-34756

CVE-2026-34756 affects vLLM OpenAI-compatible API server prior to 0.19.0. The root cause is missing upper-bound validation on the n parameter in ChatCompletionRequest/CompletionRequest, allowing an unauthenticated attacker to send an astronomically large n value that causes the asyncio event loop...

CVE-2026-34756 vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

vLLM is an inference and serving engine for large language models LLMs. From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the n parameter in the ChatCompletionRequest and CompletionReques...