CVE-2026-1839 vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, lmcache-cuda-12.8, nemo, text-generation-inference, py3-transformers, tritonserver-backend-vllm-cuda-13.0...

CVE-2026-40192 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, kubeflow-pipelines-visualization-server, text-generation-inference, open-webui, py3-vllm-cuda-12.4, superset, litellm, mlflow...

GHSA-WHJ4-6X5X-4V2J vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, kubeflow-pipelines-visualization-server, text-generation-inference, open-webui, py3-vllm-cuda-12.4, superset, litellm, mlflow...

GHSA-3MWP-WVH9-7528 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-13.0, vllm-openai-cuda-12.9, py3-vllm-cuda-12.4...

GHSA-PF3H-QJGV-VCPR vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-12.9, py3-vllm-cuda-12.4...

GHSA-PQ5C-RJHQ-QP7P vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-13.0, vllm-openai-cuda-12.9, py3-vllm-cuda-12.4...

CVE-2026-34753 vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-12.9, py3-vllm-cuda-12.4...

CVE-2026-34755 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-13.0, vllm-openai-cuda-12.9, py3-vllm-cuda-12.4...

CVE-2026-34756 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-13.0, vllm-openai-cuda-12.9, py3-vllm-cuda-12.4...

GHSA-P423-J2CM-9VMQ vulnerabilities

Vulnerabilities for packages: kserve, request-1276, label-studio, pgadmin4-fips, openstack-kolla-toolbox-2025.2, barman, open-webui, dbt-snowflake, kubeflow-pipelines-visualization-server, kubeflow-jupyter-web-app, mitmproxy, airflow-core, openstack-kolla-toolbox-2025.1, authentik, semgrep,...

CVE-2026-39892 vulnerabilities

Vulnerabilities for packages: kserve, request-1276, label-studio, pgadmin4-fips, openstack-kolla-toolbox-2025.2, barman, open-webui, dbt-snowflake, kubeflow-pipelines-visualization-server, kubeflow-jupyter-web-app, mitmproxy, airflow-core, openstack-kolla-toolbox-2025.1, authentik, semgrep,...

CVE-2026-34756

A flaw was found in vLLM, an inference and serving engine for large language models LLMs. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large 'n' parameter to the vLLM OpenAI-compatible API server. This can lead to a...

CVE-2026-34753

A flaw was found in vLLM. This server-side request forgery SSRF vulnerability allows an attacker who can control batch input JSON to force the vLLM batch runner to make arbitrary HTTP/HTTPS requests from the server. This can be exploited to access internal services, such as cloud metadata endpoin...

CVE-2026-34756

vLLM is an inference and serving engine for large language models LLMs. From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the n parameter in the ChatCompletionRequest and CompletionReques...

CVE-2026-34756

vLLM is an inference and serving engine for large language models LLMs. From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the n parameter in the ChatCompletionRequest and CompletionReques...

CVE-2026-34756 vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

vLLM is an inference and serving engine for large language models LLMs. From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the n parameter in the ChatCompletionRequest and CompletionReques...

CVE-2026-34756 vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

vLLM is an inference and serving engine for large language models LLMs. From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the n parameter in the ChatCompletionRequest and CompletionReques...

CVE-2026-34756

CVE-2026-34756 affects vLLM OpenAI-compatible API server prior to 0.19.0. The root cause is missing upper-bound validation on the n parameter in ChatCompletionRequest/CompletionRequest, allowing an unauthenticated attacker to send an astronomically large n value that causes the asyncio event loop...

CVE-2026-34755 vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing

vLLM is an inference and serving engine for large language models LLMs. From 0.7.0 to before 0.19.0, the VideoMediaIO.loadbase64 method at vllm/multimodal/media/video.py splits video/jpeg data URLs by comma to extract individual JPEG frames, but does not enforce a frame count limit. The numframes...

CVE-2026-34755 vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing

vLLM is an inference and serving engine for large language models LLMs. From 0.7.0 to before 0.19.0, the VideoMediaIO.loadbase64 method at vllm/multimodal/media/video.py splits video/jpeg data URLs by comma to extract individual JPEG frames, but does not enforce a frame count limit. The numframes...