DeutschShown in its original language — a full translation is planned for a future version.
vllm: Mehrere Schwachstellen
view advisory published 2026-10-20
Ein Angreifer kann mehrere Schwachstellen in vllm ausnutzen, um Daten zu manipulieren, einen Denial-of-Service-Angriff durchzuführen oder beliebigen Programmcode auszuführen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-114055US | high7.5 | — | ||
vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-req… | ||||
| CVE-2026-114054US | medium6.5 | — | ||
vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF Image… | ||||
| CVE-2026-114053US | high8.1 | — | ||
vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision o… | ||||
| CVE-2026-114052US | high7.5 | — | ||
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processo… | ||||
| CVE-2026-114051US | high7.5 | — | ||
vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLL… | ||||
| CVE-2026-114050US | high7.5OT elevated | — | ||
vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can… | ||||
| CVE-2026-114049US | low3.7 | — | ||
vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids r… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Advisory Database vom 2026-10-20external
- GitHub Advisory Database vom 2026-10-20external
- GitHub Advisory Database vom 2026-10-20external
- GitHub Advisory Database vom 2026-10-20external
- GitHub Advisory Database vom 2026-10-20external
- GitHub Advisory Database vom 2026-10-20external
- GitHub Advisory Database vom 2026-10-20external
- Vllm Release Notesexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan