Advisories

vLLM versions 0.11.1 through 0.32.0 are affected in the image path for DeepSeek-OCR, DeepSeek-OCR-2 and Unlimited-OCR. A remote client that can reach the OpenAI-compatible API can submit a legal image whose normalized pixels sum to zero while it is alone in its per-step encoder batch. This makes _parse_and_validate_image_input return no embedding, which triggers a fatal assertion in sanity_check_mm_encoder_outputs that shuts down the engine for all users.

vLLM versions prior to 0.32.0 use eager attention by default in the Phi-4 multimodal audio encoder (phi4mm_audio.py and phi4mm_utils.py). A remote client can submit a single legal long audio clip, causing MultiHeadedAttention.forward_attention to materialize and retain full attention matrices in self.attn. The resulting quadratic GPU memory use can trigger an out-of-memory condition that terminates EngineCore for all users.

From vLLM 0.19.0 through 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, and a malicious model repository can provide one as well. The template is rendered by tokenizer.apply_chat_template() with no wall-clock timeout, output-size limit, or iteration bound. A nonterminating render can block /v1/responses and other chat-template users, while an output-expanding render can exhaust server memory; Harmony models are not affected.

CVE-2026-116104 is a flaw in Sony Neural Network Libraries up to 1.39.0, in the func_set_nnabla_version_decorate function of python/src/nnabla/utils/converter/utils.py within the NNP Converter component. Manipulating the function.type argument leads to code injection, and the attack can be started remotely. A public exploit exists, and the vendor did not respond to early disclosure contact; the flaw affects only products no longer supported by the maintainer.

A vulnerability in Sony Neural Network Libraries up to 1.39.0 affects the function load_param_in_txt in python/src/nnabla/utils/cli/encode_decode_param.py, within the Encode Param Command Handler component. Manipulating it leads to code injection, and the attack can be launched remotely. A public exploit is available and might be used.

vLLM from 0.20.1 before 0.29.0 contains an improper input validation flaw, tracked as CVE-2026-116181. Remote attackers can supply out-of-vocabulary stop_token_ids in OpenAI chat, completion, generate, or batch requests to crash the engine or write outside the V2 runner's logits buffer.

vLLM from 0.20.0 before 0.30.0 contains a denial of service flaw that lets remote attackers crash the engine. Attackers send inconsistent multimodal metadata, such as repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists, to the disaggregated /inference/v1/generate endpoint. This produces a negative text span in Qwen2.5-VL position construction that terminates the engine.

vLLM versions from 0.19.0 before 0.24.0 contain a decompression bomb flaw in the AudioMediaIO multimodal path, which calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio through input_audio or audio_url in /v1/chat/completions requests, and the audio expands to huge decoded PCM that exhausts server memory.

vLLM from 0.22.0 before 0.24.0 has an improper input validation flaw in the Rust gRPC Generate and GenerateStream service, which forwards unchecked prompt token IDs to EngineCore. An attacker can submit requests with out-of-vocabulary prompt.token_ids values, triggering a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.

vLLM from 0.22.0 before 0.24.0 has a denial of service flaw in its Rust gRPC frontend, tracked as CVE-2026-116173. Remote attackers can bypass logprob_token_ids limits by sending Generate or GenerateStream requests with output_logprobs enabled and more than 128 output_candidates.token_ids, which triggers a fatal sampler exception that terminates EngineCore.

vLLM versions from 0.22.0 before 0.24.0 contain an improper input validation flaw in the Rust gRPC converter. Remote attackers can bypass max_logprobs limits through CandidateTokens.top_n, sending Generate or GenerateStream requests with oversized or integer-wrapping top_n values that cause torch.topk to fail and terminate EngineCore.

MLflow's tracking server exposes POST /ajax-api/3.0/mlflow/scorer/invoke without authentication, and its handler reflectively instantiates an attacker-named class from attacker-supplied JSON with unconstrained constructor kwargs. With the optional trulens and trulens-providers-litellm packages installed, an unauthenticated attacker can make the server send an outbound HTTP request to an arbitrary host carrying attacker-controlled headers.

The Postgres and SQLite stores in LangGraph joined namespace labels with `.`, so a label containing a dot, such as `("tenant.bob",)`, mapped to the same stored namespace as `("tenant", "bob")`. Although `put` rejected such labels, `get`, `search`, `delete`, `list_namespaces`, their async versions, and ops passed to `batch`/`abatch` did not, letting a caller read, overwrite or delete items in another namespace. All releases of `langgraph-checkpoint-postgres` before 3.1.3 and `langgraph-checkpoint-sqlite` before 3.1.2 are affected, while `InMemoryStore` is not.