DeutschShown in its original language — a full translation is planned for a future version.
vllm: Mehrere Schwachstellen
view advisory published 2026-10-19
Ein Angreifer kann mehrere Schwachstellen in vllm ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Sicherheitsvorkehrungen zu umgehen.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-115918US | — | — | ||
vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controll… | ||||
| CVE-2026-115917US | — | — | ||
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a w… | ||||
| CVE-2026-115916US | — | — | ||
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-token… | ||||
| CVE-2026-115914US | — | — | ||
vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client t… | ||||
| CVE-2026-115913US | — | — | ||
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention b… | ||||
| CVE-2026-115912US | — | — | ||
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public… | ||||
| CVE-2026-115911US | — | — | ||
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-tem… | ||||
| CVE-2025-62426US | — | — | ||
vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the /v1/chat/completions and /tokenize endpoints allow a chat_templat… | ||||
| CVE-2025-61620US | — | — | ||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-542m-9234-8gvf vom 2026-10-19external
- GitHub Security Advisory GHSA-6757-hggm-hp2w vom 2026-10-19external
- GitHub Security Advisory GHSA-8397-8qf6-f2gm vom 2026-10-19external
- GitHub Security Advisory GHSA-frvg-qw88-hww9 vom 2026-10-19external
- GitHub Security Advisory GHSA-gq5q-89c7-vhvx vom 2026-10-19external
- GitHub Security Advisory GHSA-h3rc-j82p-2c3h vom 2026-10-19external
- GitHub Security Advisory GHSA-q97c-p368-75c4 vom 2026-10-19external
- GitHub Security Advisory GHSA-vvpg-rrww-wpmh vom 2026-10-19external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan