vLLM EUVD-2026-58067

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0

vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev

Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th

vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons

Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),

GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS

Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion

Vllm versions up to 0.12.0 is affected by allocation of resources without limits or throttling (CVSS 6.5).

Race condition in vLLM's prompt embedding loader allows concurrent API requests to bypass the sparse tensor invariant gu

Remote code execution in vLLM 0.10.1 through 0.13.x lets an attacker who controls the model repository or path run arbit