Vulnerabilidades en vllm-project

79 resultados
Análisis Vexday

O vllm-project apresenta volume moderado de vulnerabilidades (51 CVEs) com concentração recente: 18 divulgadas nos últimos 90 dias. A fraqueza dominante (CWE-502 - Desserialização de dados não confiáveis) afeta 7 casos críticos, porém nenhuma vulnerabilidade está sob exploração ativa documentada (KEV). O risco é significativo pela cadência de descobertas recentes e pela natureza das falhas de desserialização, que tipicamente permitem execução remota de código.

CVE-2025-24357HIGHvLLM allows a malicious model RCE by torch.load in hf_model_weights_iteratorEPSS 0.7%CVE-2026-57173MEDIUMvLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completionsEPSS 0.7%CVE-2026-55514HIGHvLLM denial of service via prompt embeds on M-RoPE modelsEPSS 0.7%CVE-2025-66448HIGHvLLM vulnerable to remote code execution via transformers_utils/get_configEPSS 0.7%CVE-2026-94626HIGHvLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_sizeEPSS 0.6%CVE-2026-94622HIGHvLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer MetadataEPSS 0.6%CVE-2026-94627HIGHvLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID CollisionEPSS 0.6%CVE-2026-94624HIGHvLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading SessionsEPSS 0.6%CVE-2026-94623HIGHvLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion FailureEPSS 0.6%CVE-2026-54234HIGHvLLM: Remote DoS in vLLM via Invalid Recovered Token ReinjectionEPSS 0.6%CVE-2026-24779HIGHvLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`EPSS 0.6%CVE-2026-55574HIGHvLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backendsEPSS 0.6%CVE-2025-30202HIGHData exposure via ZeroMQ on multi-node vLLM deploymentEPSS 0.6%CVE-2026-78684MEDIUMvLLM before 0.27.0 Denial of Service via DeepStream BackendEPSS 0.6%CVE-2025-59425HIGHvLLM vulnerable to timing attack at bearer authEPSS 0.6%CVE-2026-54232HIGHvLLM: Dependency Confusion Vulnerability in vLLM DockerfileEPSS 0.6%CVE-2025-48956HIGHvLLM API endpoints vulnerable to Denial of Service AttacksEPSS 0.6%CVE-2026-73559MEDIUMvLLM: Completion prompt lists fan out into unbounded engine requestsEPSS 0.5%CVE-2026-69147MEDIUMvLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservationEPSS 0.5%CVE-2025-48942MEDIUMvLLM DOS: Remotely kill vllm over http with invalid JSON schemaEPSS 0.5%