SB2026102188 - Multiple vulnerabilities in vLLM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102188

SB2026102188 - Multiple vulnerabilities in vLLM

Published: October 21, 2026 Updated: November 9, 2026

Security Bulletin ID SB2026102188
CSH Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 13% Low 88%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Overly permissive cross-domain whitelist (CVE-ID: CVE-2026-115917)

CWE-ID: CWE-942 - Overly Permissive Cross-domain Whitelist

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose model information and model output through a victim's browser.

The vulnerability exists due to a permissive cross-origin security policy with a wildcard allowed origin in the vLLM OpenAI-compatible HTTP server's CORS middleware when handling cross-origin browser requests. A remote attacker can trick a victim into visiting a malicious web page that sends requests to an unauthenticated vLLM server reachable by the victim's browser to read model information and model output from the responses.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-115913)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to exhaust GPU memory and cause a denial of service of the vLLM engine.

The vulnerability exists due to excessive resource allocation and retention in the Phi-4 multimodal audio encoder when processing audio inputs using eager attention. A remote user can submit a request containing a 10-minute audio clip to the chat/completions API to exhaust GPU memory and crash the engine, as full attention matrices are materialized and retained on each encoder layer.


3) Input validation error (CVE-ID: CVE-2026-115915)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary commands or cause a denial of service through vulnerable image-processing dependencies.

The vulnerability exists due to improper input validation in vLLM's ImageMediaIO when selecting a decoder for untrusted image bytes. A remote attacker can submit EPS content labeled image/png to reach Pillow's EPS processing path regardless of the declared MIME type, enabling command execution with a vulnerable host Ghostscript build or exhaustion of media-loading workers with an affected Pillow version.


4) Off-by-one (CVE-ID: CVE-2026-115916)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service by crashing the vLLM engine.

The vulnerability exists due to an off-by-one error in vLLM's input token ID validation when processing pre-tokenized prompts. A remote user can submit a prompt containing a token ID equal to the model's vocabulary size to trigger an out-of-range embedding lookup at tensor-parallel size 1, causing a CUDA device-side assertion that invalidates the engine's CUDA context and stops the engine.

The crash affects models whose vocabulary size is a multiple of 64 and whose tokenizer.vocab_size is one greater than the largest real token ID.


5) Reachable assertion (CVE-ID: CVE-2026-115914)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service by crashing the entire vLLM serving instance.

The vulnerability exists due to a reachable assertion in vLLM's DeepSeek-OCR-family multimodal encoder when processing an image whose normalized pixel values sum to exactly zero. A remote user can submit a chat request containing a 1024×1024 PNG image that is half pure black and half pure white to make embed_multimodal return None, triggering an uncontained assertion failure that terminates the engine and shuts down the API server.

The trigger image must be alone in its per-step encoder batch because the zero-sum check aggregates across the entire modality batch.


6) Resource exhaustion (CVE-ID: CVE-2026-94624)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to terminate vLLM's inference service through ZeroMQ socket exhaustion.

The vulnerability exists due to retention of never-established peer sessions when OffloadingConnector uses TieringOffloadingSpec with a P2P secondary tier. A low-privileged remote attacker can submit requests containing unique non-listening peer addresses in kv_transfer_params.prefill, using a normal API key when authentication is enabled, to exhaust sockets and shut down the API server.


7) Resource exhaustion (CVE-ID: CVE-2026-115911)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated remote attacker to deny chat-style inference to every tenant of a vLLM API-server replica until restart.

The vulnerability exists due to unbounded Jinja2 chat-template rendering with a non-harmony model, the default single renderer worker, and no configured --chat-template override. An authenticated remote attacker can submit one crafted template through /v1/responses to occupy the renderer indefinitely and block subsequent chat requests.


8) Deserialization of Untrusted Data (CVE-ID: CVE-2026-115912)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated remote attacker to execute arbitrary Python code in a vLLM worker process.

The vulnerability exists due to unvalidated shared-memory handles reaching unsafe deserialization in the multimodal cache when --mm-processor-cache-type shm is enabled. An authenticated remote attacker can stage malicious bytes through public inference requests and submit a forged handle to trigger code execution, even with VLLM_ALLOW_INSECURE_SERIALIZATION=0.


Remediation

Install update from vendor's website.

References