vLLM 安全漏洞

vLLM is an open-source inference and service engine designed for LLM models, featuring high throughput and efficient memory usage. Versions of vLLM prior to 0.19.0 contained a security vulnerability. This vulnerability stemmed from a function in the KV Block Handler component called...

PT-2026-35459

A vulnerability was found in vllm up to 0.19.0. The affected element is the function has mamba layers of the file vllm/v1/kv cache interface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource. It is possible to initiate the attack remotely. The attac...

CVE-2026-1839 vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-12.9, lmcache-cuda-12.8, tritonserver-backend-vllm-cuda-13.0, tritonserver-backend-vllm-cuda-12.9, py3-transformers, text-generation-inference, nemo...

GHSA-69W3-R845-3855 vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-12.9, lmcache-cuda-12.8, tritonserver-backend-vllm-cuda-13.0, tritonserver-backend-vllm-cuda-12.9, py3-transformers, text-generation-inference, nemo...

CVE-2026-40192 vulnerabilities

Vulnerabilities for packages: superset, kubeflow-pipelines-visualization-server, litellm, py3-vllm-cuda-12.4, tritonserver-backend-vllm-cuda-12.9, text-generation-inference, open-webui...

GHSA-WHJ4-6X5X-4V2J vulnerabilities

Vulnerabilities for packages: superset, kubeflow-pipelines-visualization-server, litellm, py3-vllm-cuda-12.4, tritonserver-backend-vllm-cuda-12.9, text-generation-inference, open-webui...

CVE-2026-34755 vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-13.0, py3-vllm-cuda-12.4...

CVE-2026-34753 vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-12.9, py3-vllm-cuda-12.4...

GHSA-PQ5C-RJHQ-QP7P vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-13.0, py3-vllm-cuda-12.4...

GHSA-3MWP-WVH9-7528 vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-13.0, py3-vllm-cuda-12.4...

GHSA-PF3H-QJGV-VCPR vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-12.9, py3-vllm-cuda-12.4...

CVE-2026-34756 vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-13.0, py3-vllm-cuda-12.4...

GHSA-P423-J2CM-9VMQ vulnerabilities

Vulnerabilities for packages: dagster, barman, py3-cassandra-medusa, apache-beam-python-3.12-sdk, gitlab-cng-fips, airflow, datadog-agent-fips, dask-kubernetes, wazuh-manager, kubeflow-jupyter-web-app, airflow-core, jupyter-base-notebook, nemo, open-webui, mitmproxy, kubeflow-volumes-web-app,...

CVE-2026-39892 vulnerabilities

Vulnerabilities for packages: dagster, barman, py3-cassandra-medusa, apache-beam-python-3.12-sdk, gitlab-cng-fips, airflow, datadog-agent-fips, dask-kubernetes, wazuh-manager, kubeflow-jupyter-web-app, airflow-core, jupyter-base-notebook, nemo, open-webui, mitmproxy, kubeflow-volumes-web-app,...

CVE-2026-34756

A flaw was found in vLLM, an inference and serving engine for large language models LLMs. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large 'n' parameter to the vLLM OpenAI-compatible API server. This can lead to a...

CVE-2026-34753

A flaw was found in vLLM. This server-side request forgery SSRF vulnerability allows an attacker who can control batch input JSON to force the vLLM batch runner to make arbitrary HTTP/HTTPS requests from the server. This can be exploited to access internal services, such as cloud metadata endpoin...

CVE-2026-34756

vLLM is an inference and serving engine for large language models LLMs. From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the n parameter in the ChatCompletionRequest and CompletionReques...

CVE-2026-34756 vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

vLLM is an inference and serving engine for large language models LLMs. From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the n parameter in the ChatCompletionRequest and CompletionReques...

CVE-2026-34756

vLLM is an inference and serving engine for large language models LLMs. From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the n parameter in the ChatCompletionRequest and CompletionReques...

CVE-2026-34756

CVE-2026-34756 affects vLLM OpenAI-compatible API server prior to 0.19.0. The root cause is missing upper-bound validation on the n parameter in ChatCompletionRequest/CompletionRequest, allowing an unauthenticated attacker to send an astronomically large n value that causes the asyncio event loop...