SB2026060243 - Multiple vulnerabilities in vLLM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026060243

SB2026060243 - Multiple vulnerabilities in vLLM

Published: June 2, 2026 Updated: July 2, 2026

Security Bulletin ID SB2026060243
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-48746)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication and use the API without providing a valid API key.

The vulnerability exists due to inconsistent interpretation of HTTP requests in OpenAI API AuthenticationMiddleware when processing requests with a crafted Host header that alters the reconstructed URL path. A remote attacker can send a specially crafted request with invalid characters in the Host header to bypass authentication and use the API without providing a valid API key.

Only instances that use an API key for the OpenAI API and are exposed to attackers are vulnerable. Instances behind an RFC-conforming web server such as nginx are not affected.


2) Insufficient verification of data authenticity (CVE-ID: CVE-2026-47155)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause pinned deployments to load unpinned code, weights, and processors.

The vulnerability exists due to insufficient verification of data authenticity in artifact revision pinning across model loaders and dynamic module resolution when resolving model-related artifacts from repositories. A remote attacker can modify or rely on mutable unpinned secondary artifacts to cause pinned deployments to load unpinned code, weights, and processors.

This affects supported loader paths where explicit model or code revision pins are not consistently propagated to secondary artifacts such as dynamic modules, GGUF files, image processors, and same-repository subfolder resources.


3) Code Injection (CVE-ID: CVE-2026-41523)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to code injection in the activation function loading logic in vllm/model_executor/layers/pooler/activations.py when loading a crafted HuggingFace model configuration while Python optimized mode disables the assert-based security check. A remote attacker can publish a malicious model with a crafted config.json to execute arbitrary code.

User interaction is required to load the malicious model, and exploitation requires Python optimized mode and a cross-encoder architecture.


Remediation

Install update from vendor's website.

References