DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
vllm: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-10-19
Ein Angreifer kann mehrere Schwachstellen in vllm ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Sicherheitsvorkehrungen zu umgehen.
01
beschreibt (9)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-115918US | — | — | ||
vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controll… | ||||
| CVE-2026-115917US | — | — | ||
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a w… | ||||
| CVE-2026-115916US | — | — | ||
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-token… | ||||
| CVE-2026-115914US | — | — | ||
vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client t… | ||||
| CVE-2026-115913US | — | — | ||
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention b… | ||||
| CVE-2026-115912US | — | — | ||
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public… | ||||
| CVE-2026-115911US | — | — | ||
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-tem… | ||||
| CVE-2025-62426US | — | — | ||
vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the /v1/chat/completions and /tokenize endpoints allow a chat_templat… | ||||
| CVE-2025-61620US | — | — | ||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- GitHub Security Advisory GHSA-542m-9234-8gvf vom 2026-10-19external
- GitHub Security Advisory GHSA-6757-hggm-hp2w vom 2026-10-19external
- GitHub Security Advisory GHSA-8397-8qf6-f2gm vom 2026-10-19external
- GitHub Security Advisory GHSA-frvg-qw88-hww9 vom 2026-10-19external
- GitHub Security Advisory GHSA-gq5q-89c7-vhvx vom 2026-10-19external
- GitHub Security Advisory GHSA-h3rc-j82p-2c3h vom 2026-10-19external
- GitHub Security Advisory GHSA-q97c-p368-75c4 vom 2026-10-19external
- GitHub Security Advisory GHSA-vvpg-rrww-wpmh vom 2026-10-19external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan