Vulnerabilidades em vllm-project
125 resultadosAnálise Vexday
O vllm-project apresenta volume moderado de vulnerabilidades (51 CVEs) com concentração recente: 18 divulgadas nos últimos 90 dias. A fraqueza dominante (CWE-502 - Desserialização de dados não confiáveis) afeta 7 casos críticos, porém nenhuma vulnerabilidade está sob exploração ativa documentada (KEV). O risco é significativo pela cadência de descobertas recentes e pela natureza das falhas de desserialização, que tipicamente permitem execução remota de código.
CVE-2026-22773MEDIUMvLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensionsEPSS 0.4%CVE-2026-34756MEDIUMvLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API ServerEPSS 0.4%CVE-2026-94624HIGHvLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading SessionsEPSS 0.4%CVE-2025-46570LOWvLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-ChannelEPSS 0.4%CVE-2026-9540MEDIUMvllm-project vllm OpenAI-compatible Serving Path denial of serviceEPSS 0.4%CVE-2026-105753MEDIUMvLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine coreEPSS 0.4%CVE-2026-54233MEDIUMvLLM: OOM Denial of Service via Audio Decompression BombEPSS 0.4%CVE-2026-114055HIGHvLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargsEPSS 0.4%CVE-2026-100652HIGHvLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_idsEPSS 0.4%CVE-2026-44222MEDIUMvLLM: Remote DoS via Special-Token PlaceholdersEPSS 0.4%CVE-2026-73558MEDIUMvLLM: Cross-User Data Leak VulnerabilityEPSS 0.4%CVE-2026-73555MEDIUMvLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error MessagesEPSS 0.4%CVE-2026-105759MEDIUMvLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)EPSS 0.4%CVE-2025-62372HIGHvLLM vulnerable to DoS with incorrect shape of multimodal embedding inputsEPSS 0.4%CVE-2026-73560MEDIUMvLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protectionsEPSS 0.4%CVE-2026-115914MEDIUMvLLM DeepSeek-OCR image processing vulnerable to denial of serviceEPSS 0.4%CVE-2026-100651HIGHvllm before 0.29.0 Denial of Service via Decoder Prompt Length BypassEPSS 0.4%CVE-2026-114051HIGHvLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generateEPSS 0.4%CVE-2026-116181HIGHvLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_idsEPSS 0.4%CVE-2026-71486MEDIUMvLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output boundsEPSS 0.4%