Security Advisories · vllm-project/vllm · GitHub

Security Advisories

View known security vulnerabilities and report new vulnerabilities privately to maintainers.

Report a vulnerability

GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving
GHSA-5jv2-g5wq-cmr4 published Jun 11, 2026 by jperezdealgaba

Moderate
Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing
GHSA-pq5c-rjhq-qp7p published Apr 3, 2026 by russellb

Moderate
Server-Side Request Forgery (SSRF) in `download_bytes_from_url `
GHSA-pf3h-qjgv-vcpr published Apr 3, 2026 by russellb

Moderate
OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server
GHSA-3mwp-wvh9-7528 published Apr 3, 2026 by russellb

Moderate
Hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out
GHSA-7972-pg2x-xr59 published Mar 26, 2026 by russellb

High
SSRF Protection Bypass in vLLM
GHSA-v359-jj2v-j536 published Mar 9, 2026 by russellb

Moderate
OpenAI API Auth Bypass
GHSA-94f4-hr76-p5j6 published Jun 2, 2026 by russellb

Critical
Server-Side Request Forgery (SSRF) in `MediaConnector`
GHSA-qh4c-xf7m-gxfc published Jan 27, 2026 by russellb

High
vLLM RCE In Video Processing
GHSA-4r2x-xpjr-7cvv published Feb 2, 2026 by russellb

Critical
RCE via auto_map dynamic module loading during model initialization
GHSA-2pc9-4j83-qjmr published Jan 21, 2026 by russellb

High