CVE-2026-100653: vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-

vLLM (an engine for running large language models) versions 0.22.1 through 0.28.0 have a bug where certain model settings are not applied correctly for two specific model types (FunAudioChat and Tarsier2). When operators pin their deployments to a specific version for safety, the system still pulls some components (tokenizers and configs, which control how audio is processed) from the default upstream version instead, meaning unexpected changes to the base repository could alter how the model behaves without the operator knowing.