--- title: "vLLM vulnerabilities: CVEs, CISA KEV and security advisories" url: https://radicalnotion.ai/vendor/vllm type: vendor description: "vLLM has 135 published CVEs, 0 in CISA KEV and 48 with public exploits." updated: 2026-10-26 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # vLLM vulnerabilities - **Published CVEs:** 135 - **In CISA KEV:** 0 - **With a public exploit:** 48 - **With a patch:** 131 - **Average CVSS:** 7.1 - **CVEs in the last two years:** 133 - **First CVE:** 2024-09-17 - **Latest CVE:** 2026-10-26 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 11 | | High | 58 | | Medium | 61 | | Low | 5 | | Unscored | 0 | ## Most affected products | Product | CVEs | | --- | --- | | [vLLM](https://radicalnotion.ai/vendor/vllm/vllm) | 132 | | [vllm-project/vllm](https://radicalnotion.ai/vendor/vllm/vllm-project-vllm) | 4 | | [AIBrix](https://radicalnotion.ai/vendor/vllm/aibrix) | 1 | | [vllm-gaudi](https://radicalnotion.ai/vendor/vllm/vllm-gaudi) | 1 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-400](https://radicalnotion.ai/cwe/cwe-400) | Uncontrolled Resource Consumption | 22 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 16 | | [CWE-770](https://radicalnotion.ai/cwe/cwe-770) | Allocation of Resources Without Limits or Throttling | 14 | | [CWE-129](https://radicalnotion.ai/cwe/cwe-129) | Improper Validation of Array Index | 9 | | [CWE-502](https://radicalnotion.ai/cwe/cwe-502) | Deserialization of Untrusted Data | 8 | | [CWE-918](https://radicalnotion.ai/cwe/cwe-918) | Server-Side Request Forgery (SSRF) | 6 | | [CWE-617](https://radicalnotion.ai/cwe/cwe-617) | Reachable Assertion | 5 | | [CWE-94](https://radicalnotion.ai/cwe/cwe-94) | Improper Control of Generation of Code ('Code Injection') | 5 | ## Assigning CNAs | CNA | CVEs | | --- | --- | | [GitHub\_M](https://radicalnotion.ai/cna/github-m) | 72 | | [VulnCheck](https://radicalnotion.ai/cna/vulncheck) | 43 | | [VulDB](https://radicalnotion.ai/cna/vuldb) | 10 | | [redhat](https://radicalnotion.ai/cna/redhat) | 4 | | [@huntr\_ai](https://radicalnotion.ai/cna/huntr-ai) | 4 | | [mitre](https://radicalnotion.ai/cna/mitre) | 1 | | [intel](https://radicalnotion.ai/cna/intel) | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2024 | 2 | | 2025 | 26 | | 2026 | 107 | ## Latest CVEs | CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-115918 | vLLM: Responses API bypasses trust\_request\_chat\_template for chat\_template\_kwargs | medium | 6.5 | 0.4% | No | 2026-10-26 | | CVE-2026-115917 | vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server | medium | 4.7 | 0.2% | No | 2026-10-26 | | CVE-2026-115916 | vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) | medium | 6.5 | 0.3% | No | 2026-10-26 | | CVE-2026-115915 | vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE | critical | 9.8 | 0.7% | No | 2026-10-26 | | CVE-2026-115914 | vLLM DeepSeek-OCR image processing vulnerable to denial of service | medium | 6.5 | 0.4% | No | 2026-10-26 | | CVE-2026-115913 | vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine | medium | 6.5 | 0.3% | No | 2026-10-26 | | CVE-2026-115912 | vLLM: Public multimodal SHM handle forgery reaches worker-side \`pickle.loads()\` with insecure serialization disabled | high | 8.8 | 0.5% | No | 2026-10-26 | | CVE-2026-115911 | vLLM: DoS via unbounded chat\_template Jinja2 rendering exhausts the renderer thread pool | medium | 6.5 | 0.3% | No | 2026-10-26 | | CVE-2026-116181 | vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop\_token\_ids | high | 7.1 | 0.4% | No | 2026-10-25 | | CVE-2026-116180 | vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors | high | 8.3 | 0.3% | No | 2026-10-25 | | CVE-2026-116179 | vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media\_io\_kwargs num\_frames Override | high | 8.7 | 0.3% | No | 2026-10-25 | | CVE-2026-116178 | vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm\_placeholders | high | 8.2 | 0.3% | No | 2026-10-25 | ## Frequently asked questions ### How many CVEs does vLLM have? vLLM has 135 published CVE records since 2024, including 133 in the last two years. ### How many vLLM CVEs are in CISA KEV? None of vLLM's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Which vLLM products have the most CVEs? The vLLM products with the most published CVEs are vLLM, vllm-project/vllm, AIBrix, vllm-gaudi. ### What are the most common weakness types in vLLM CVEs? vLLM's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-20 (Improper Input Validation), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-129 (Improper Validation of Array Index). ### Are there public exploits for vLLM vulnerabilities? Yes — 48 of vLLM's CVEs have a known public exploit. ### How many critical vLLM vulnerabilities are there? vLLM has 11 critical and 58 high-severity CVEs. ### What is the average severity of vLLM CVEs? The average CVSS base score across vLLM's scored CVEs is 7.1. ## Related vendors - [Crocoblock](https://radicalnotion.ai/vendor/crocoblock) (136 CVEs) - [Ruijie](https://radicalnotion.ai/vendor/ruijie) (136 CVEs) - [Tanium](https://radicalnotion.ai/vendor/tanium) (136 CVEs) - [Themeisle](https://radicalnotion.ai/vendor/themeisle) (136 CVEs) - [WebKitGTK](https://radicalnotion.ai/vendor/webkitgtk) (135 CVEs) - [Go standard library](https://radicalnotion.ai/vendor/gostandardlibrary) (135 CVEs) - [Motorola](https://radicalnotion.ai/vendor/motorola) (134 CVEs) - [Checkmk](https://radicalnotion.ai/vendor/checkmk) (134 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/vllm). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.