SB2026090133 - Multiple vulnerabilities in vLLM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090133

SB2026090133 - Multiple vulnerabilities in vLLM

Published: September 1, 2026 Updated: November 11, 2026

Security Bulletin ID SB2026090133
CSH Severity
High
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 14% Medium 14% Low 71%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Inclusion of Functionality from Untrusted Control Sphere (CVE-ID: CVE-2026-90553)

CWE-ID: CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to inclusion of functionality from an untrusted control sphere in the LlavaOnevision2 processor loader _load_ov2_processor when loading a crafted LlavaOnevision2 model. A remote attacker can supply malicious processor modules that are imported and executed to execute arbitrary code.

User interaction is required to load or serve the crafted model, and code runs with the authority of the vLLM process.


2) Resource exhaustion (CVE-ID: CVE-2026-90554)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in load_audio_pyav in nano_nemotron_vl.py when processing crafted video input for audio extraction. A remote attacker can supply a small compressed video file to trigger excessive memory allocation and cause a denial of service.

Exploitation is reachable through LLM.generate() with multi_modal_data when using NanoNemotronVL models with use_audio_in_video enabled and no separate audio file.


3) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-90555)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to reliance on untrusted inputs in a security decision in the /v1/audio/transcriptions audio decoding path when processing a crafted audio file with a forged header sample rate. A remote user can submit a specially crafted FLAC file to cause a denial of service.

Exploitation requires a valid API key and a transcription-capable model with the /v1/audio/* endpoint mounted.


4) Resource exhaustion (CVE-ID: CVE-2026-69147)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the video decoding path when processing video requests with a request-selected PyNvVideoCodec backend. A remote user can send a specially crafted video request to cause a denial of service.

Exploitation requires a GPU deployment where PyNvVideoCodec is installed and usable, and the request must reach a video-capable model or path.


5) Improper Validation of Array Index (CVE-ID: CVE-2026-93592)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of array indices in InputProcessor._validate_model_input for the /v1/embeddings and /pooling endpoints when processing token-id input containing a negative value. A remote attacker can send a request containing a negative token id to cause a denial of service.


6) Reachable assertion (CVE-ID: CVE-2026-105753)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to deny service by causing subsequent multimodal requests to fail in vLLM.

The vulnerability exists due to desynchronization of mirrored multimodal caches under the default LRU configuration when a request is rejected after rendering but before reaching the engine core. A low-privileged remote attacker can submit an oversized prompt containing media, then reuse the same media hash in another request to trigger a receiver assertion and fail that request.


7) Exposure of Data Element to Wrong Session (CVE-ID: N/A)

CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disrupt another concurrent request's generation by forcing the configured reasoning-end sequence, such as </think>, into its output.

The vulnerability exists due to failure to remove source entries in the V1 model runner's ThinkingBudgetStateHolder.sync_batch() when swapping a budgeted row with an unbudgeted row, aliasing mutable state across requests. A remote user can submit a completion request with thinking_token_budget and groom the queue to trigger a mixed batch swap on a reasoning-enabled server to force the configured reasoning-end sequence into a victim's output.


Remediation

Install update from vendor's website.

References