758 matches found
GHSA-83VM-P52W-F9PW vulnerabilities
Vulnerabilities for packages: vllm-openai-cuda-12.9...
CVE-2026-44223 vulnerabilities
Vulnerabilities for packages: vllm-openai-cuda-12.9...
CVE-2026-37237
A flaw was found in vLLM. Remote attackers can exploit this vulnerability by providing a URL to an excessively large media file. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions, responsible for fetching user-supplied media, do not limit the response size. This oversight allows a...
CVE-2026-37237
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read without enforcing a maximum response...
CVE-2026-37237
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read without enforcing a maximum response...
CVE-2026-37237
vLLM (versions up to and including 0.17.0 ) is vulnerable to a Denial of Service via memory exhaustion . The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read() without enforcing a maximum response ...
EUVD-2026-67775
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read without enforcing a maximum response...
CVE-2026-78684
A flaw was found in vLLM. Unauthenticated attackers can exploit this vulnerability by activating the DeepStream backend during a request. This allows them to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, leading to a partial denial of service for...
CVE-2026-73560
A flaw was found in vLLM, an inference and serving engine for large language models. The MiMoV2OmniMultiModalProcessor component improperly handles attacker-controlled image and audio strings, bypassing security protections. This vulnerability allows a remote attacker to perform Server-Side Reque...
CVE-2026-71486
A flaw was found in vLLM. An authenticated API client can exploit derender endpoints by providing oversized GenerateResponse objects. These endpoints process the objects without enforcing output bounds or response-size limits. This can lead to excessive consumption of CPU and memory resources,...
GHSA-87X5-VMC3-756J vulnerabilities
Vulnerabilities for packages: vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...
CVE-2026-73559 vulnerabilities
Vulnerabilities for packages: vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...
CVE-2026-78684
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...
EUVD-2026-65457
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...
CVE-2026-78684 vLLM before 0.27.0 Denial of Service via DeepStream Backend
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...
CVE-2026-78684 vLLM before 0.27.0 Denial of Service via DeepStream Backend
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...
CVE-2026-78684 vLLM before 0.27.0 Denial of Service via DeepStream Backend
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...
CVE-2026-78684
vLLM versions prior to 0.27.0 are susceptible to a denial-of-service condition through improper handling of the DeepStream backend. The root cause is a failure to classify DeepStream as a GPU backend combined with missing pixel-limit enforcement in the decode path. An unauthenticated attacker can...