AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

vllm

A high-throughput and memory-efficient inference and serving engine for LLMs

Declares an LLM dependency since 2023-08-25 (version 0.1.4).

PyPILatest 0.31.0First release 2023-06-19Registry page RepositoryChecked 2026-10-09

Advisories

Advisories that name vllm as affected. Advisory records do not state an ecosystem, so packages with the same name in other ecosystems also match. For a version-exact check of your own dependencies, use Stack Check.

Advisory	Severity	Affected	Fixed in	Published
CVE-2026-105758GHSA-x6mc-67gf-chw4: vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach	Medium	>= 0.24.0, < 0.30.0	0.30.0	2026-10-05
CVE-2026-105760GHSA-58v5-2m8f-94pr: vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion	Medium	>= 0.23.0rc2, < 0.30.0	0.30.0	2026-10-05
CVE-2026-105754GHSA-ph72-cqr5-qpp7: vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features	Medium	< 0.30.0	0.30.0	2026-10-05
CVE-2026-105757GHSA-85xf-c7hm-whqw: vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)	Medium	< 0.30.0	0.30.0	2026-10-05
CVE-2026-105755GHSA-2phq-3phc-84px: vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`	Medium	< 0.30.0	0.30.0	2026-10-05
CVE-2026-105756GHSA-2823-qmq8-rwvj: vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service	Medium	< 0.30.0	0.30.0	2026-10-05
CVE-2026-54233GHSA-6pr9-rp53-2pmc: vLLM: OOM Denial of Service via Audio Decompression Bomb	Medium	<= 0.23.0		2026-06-17
CVE-2026-54236GHSA-hgg8-fqqc-vfmw: vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router	Medium	<= 0.23.0		2026-06-17
CVE-2026-53923GHSA-5jv2-g5wq-cmr4: vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving	Medium	>= 0.5.5, <= 0.23.0		2026-06-17
GHSA-8jr5-v98p-w75m: vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations	Medium	>= 0.11.0, <= 0.23.0		2026-06-17
CVE-2026-54235GHSA-7h4p-rffg-7823: vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels	Medium	<= 0.23.0		2026-06-17
CVE-2026-48746GHSA-94f4-hr76-p5j6: vLLM: OpenAI auth bypass	Critical	>= 0.3.0, < 0.22.0	0.22.0	2026-06-16
CVE-2026-41523GHSA-q8gq-377p-jq3r: vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution	High	< 0.22.0	0.22.0	2026-06-16
CVE-2026-47155GHSA-3ww4-5jv9-j5gm: vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors	Medium	< 0.22.0	0.22.0	2026-06-10
CVE-2026-44223GHSA-83vm-p52w-f9pw: vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters	Medium	>= 0.18.0, < 0.20.0	0.20.0	2026-05-06
CVE-2026-44222GHSA-hpv8-x276-m59f: vLLM Vulnerable to Remote DoS via Special-Token Placeholders	Medium	>= 0.6.1, < 0.20.0	0.20.0	2026-05-05
CVE-2026-34755GHSA-pq5c-rjhq-qp7p: vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing	Medium	>= 0.7.0, < 0.19.0	0.19.0	2026-04-03
CVE-2026-34753GHSA-pf3h-qjgv-vcpr: vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `	Medium	>= 0.16.0, < 0.19.0	0.19.0	2026-04-03
CVE-2026-34756GHSA-3mwp-wvh9-7528: vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server	Medium	>= 0.1.0, < 0.19.0	0.19.0	2026-04-03
CVE-2026-25960GHSA-v359-jj2v-j536: vLLM has SSRF Protection Bypass	Medium	>= 0.15.1, < 0.17.0	0.17.0	2026-03-09

Dependencies of the latest release

As declared in PyPI metadata for version 0.31.0. Optional extras are listed with their extra name.

anthropicAnthropic SDK
b12x[b12x]Hugging Face Hub / Transformers
compressed-tensorsHugging Face Hub / Transformers
datasets[bench]FAISS, Hugging Face Hub / Transformers
fastsafetensorsHugging Face Hub / Transformers
huggingface-hubHugging Face Hub / Transformers
mcpModel Context Protocol SDK
mistral-commonHugging Face Hub / Transformers
openaiOpenAI SDK
outlines-coreOutlines
safetensorsHugging Face Hub / Transformers
smg-grpc-servicer[grpc]Hugging Face Hub / Transformers
tokenizersHugging Face Hub / Transformers
transformersHugging Face Hub / Transformers
xgrammarHugging Face Hub / Transformers
humming-kernelsreaches LLM
instanttensorreaches LLM
pandas[bench]reaches LLM
vllm-gguf-plugin[extra-quant]reaches LLM
zentorch[zen]reaches LLM
plotly[bench]reaches LLM
quack-kernelsreaches LLM
scipy[bench]reaches LLM
seaborn[bench]reaches LLM
helion[helion]reaches LLM
soxr[audio]reaches LLM
torchreaches LLM
torchvisionreaches LLM
depyfreaches LLM
flashinfer-pythonreaches LLM
jsonschemareaches LLM
matplotlib[bench]reaches LLM
nvtxreaches LLM
pillowreaches LLM
prometheus-clientreaches LLM
psutilreaches LLM
requestsreaches LLM
runai-model-streamer[runai]reaches LLM
sentencepiecereaches LLM
setproctitlereaches LLM
setuptoolsreaches LLM
tensorizer[tensorizer]reaches LLM
tilelangreaches LLM
tokenspeed-mlareaches LLM
torchcodecreaches LLM
tqdmreaches LLM
aiohttpreaches LLM
fastapireaches LLM
model-hosting-container-standardsreaches LLM
nvidia-cudnn-frontendreaches LLM
partial-json-parserreaches LLM
prometheus-fastapi-instrumentatorreaches LLM
pydanticreaches LLM
starlettereaches LLM
tiktokenreaches LLM
watchfilesreaches LLM
apache-tvm-ffi
av[audio]
blake3
cachetools
cbor2
cloudpickle
einops
filelock
ijson
lark
llguidance
lm-format-enforcer
msgspec
ninja
numba
numpy
nvidia-cutlass-dsl
nvidia-deepstream-videodecode-cu13[deepstream]
opencv-python-headless
opentelemetry-api
opentelemetry-exporter-otlp
opentelemetry-sdk
opentelemetry-semantic-conventions-ai
oss-harmony
protobuf
pybase64
py-cpuinfo
pynvvideocodec
python-json-logger
pyyaml
pyzmq
regex
six
soundfile[audio]
torchaudio
typing-extensions

Tracked packages that depend on it

Among the packages in the registry; not every dependent on PyPI.