EUVD-2026-92962
GHSA-qx62-jwpf-rcpj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege vLLM API access
-
ExploitCraft malicious completions request
-
ExecutionTrigger out-of-bounds read in conv_ssm_forward
-
ImpactCrash/degrade inference worker availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a network-reachable vLLM instance serving a Mamba/Mamba2-architecture model, since the flaw is in conv_ssm_forward within vllm/model_executor/layers/mamba/mamba_mixer2.py - deployments running only standard transformer models are unlikely to reach the vulnerable code path. The CVSS vector's PR:L indicates valid low-privilege access to the completions API is needed, so fully anonymous exploitation is not confirmed; no user interaction is required (UI:N). Limiting factors: the specific Mamba2 model requirement, the need for API access, and that impact is bounded to low availability (worker crash/degradation) rather than code execution or data theft. Affected: vllm-project vLLM versions up to 0.31.0. |
| Impact | This is a moderate, not top-tier, priority. The CVSS 4.0 base score of 5.3 (vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) describes a network-reachable, low-complexity flaw that requires some level of privilege (PR:L - i.e. valid API access) and yields only LOW availability impact with NO confidentiality or integrity impact. The E:P in the vector corresponds to the publicly available PoC (a GitHub issue). This is NOT in CISA KEV and there is no EPSS value supplied, so there is no evidence of active or widespread exploitation - the realistic worst case is a crash/denial-of-service of an inference worker, not data theft or RCE. NOTE A CONFLICT: the input Tags include 'Information Disclosure' and 'Buffer Overflow', and the CWE is CWE-125 (out-of-bounds read, which classically can leak memory), yet the authoritative CVSS vector sets VC:N (no confidentiality impact) and attributes impact solely to availability (VA:L). Treat the 'information disclosure' framing with caution - per the vector this is an availability bug, and the discrepancy should be verified against the actual PoC/issue before claiming memory disclosure. The vulnerability is also unconfirmed by the vendor: the report states the project was notified via an issue and has not responded, so affected-version and fix data are vendor-unvalidated. |
| Exploit ScenarioDerived | An attacker who already has access to a reachable vLLM completions endpoint (e.g. a tenant API key on a shared inference service) submits a specially crafted request that drives the Mamba2 mixer's conv_ssm_forward routine to read out of bounds, crashing or degrading the inference worker. A public PoC exists in the form of the disclosed GitHub issue, lowering the barrier to reproduction. Because only low-privilege API access is needed and no user interaction is required, this is feasible against any multi-tenant deployment serving a Mamba-architecture model. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
An out-of-bounds read in vLLM up to and including version 0.31.0 lets a caller with low-privilege access to the completions API drive the SSM convolution path past the end of a buffer, degrading availability of the inference worker. The flaw is confined to deployments that serve Mamba/Mamba2-architecture models, because it lives in conv_ssm_forward of vllm/model_executor/layers/mamba/mamba_mixer2.py; instances running only standard transformer models are unlikely to reach the vulnerable code. Publicly available exploit code exists, but there is no confirmed active exploitation (not listed in CISA KEV); the independent assessment bounds impact to low availability loss with no confidentiality or integrity effect, making this a moderate rather than top-tier priority.
RemediationAI
No vendor-released patch identified at time of analysis: the upstream project was reportedly notified via issue 57266 but has not yet responded or shipped a fix, so no corrected vLLM version can be cited - track https://github.com/vllm-project/vllm/issues/57266 and https://github.com/vllm-project/vllm/ for the eventual release and upgrade as soon as a fixed tag appears. Until then, the most effective compensating control is to avoid loading Mamba/Mamba2-architecture checkpoints on any network-reachable vLLM instance; the trade-off is that Mamba2 models simply cannot be served, but this removes the vulnerable code path entirely. If Mamba2 serving is required, restrict the completions endpoint to trusted, authenticated clients (the vector's PR:L shows valid low-privilege API credentials are needed, so network exposure to untrusted users is the primary amplifier) by placing it behind an authenticating gateway or network ACL and issuing per-tenant API keys - the trade-off is added operational overhead and reduced multi-tenant flexibility. Additionally, isolate SSM-serving workers in separate processes/containers with restart-on-crash and resource limits to contain the availability impact, and monitor logs for repeated worker crashes on Mamba2 requests as an exploitation indicator; note that these mitigations reduce but do not eliminate exposure, since the underlying out-of-bounds read remains until an upstream fix is released.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is vLLM's Mamba2 mixer layer, which implements a state-space model (SSM) block. In Mamba2 architectures the input is first passed through a short causal convolution before the selective state-space recurrence, and conv_ssm_forward is the function that applies this convolution and dispatches into the SSM scan inside vllm/model_executor/layers/mamba/mamba_mixer2.py. The reported weakness is CWE-125 (Out-of-bounds Read): the convolution routine can index beyond the bounds of its input/hidden-state buffer, so reads return memory outside the intended tensor rather than raising a clean error. CPE data (cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*) marks the whole vLLM product line as affected up to 0.31.0, with no fixed version enumerated. Because the vulnerable code sits behind the Mamba2 model implementation, the attack surface is the completions request handler only when a Mamba/Mamba2 checkpoint is loaded; transformer-based serving paths never instantiate this layer. VulDB's accompanying tags reference "Buffer Overflow" and "Information Disclosure," but the assessed vector (VC:N/VI:N/VA:L) shows no confidentiality or integrity loss, so those tags overstate the practical impact - the realistic outcome is a worker crash or degraded generation, not memory disclosure to the attacker.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Remote API-triggered (AV:N/AC:L) but needs valid low-privilege access (PR:L); vendor vector attributes impact to availability only (A:L) with no confidentiality/integrity, so C:N/I:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/model_executor/layers/mamba/mamba_mixer2.py of the component Completions Request Handler. The manipulation leads to out-of-bounds read. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Vllm versions up to 0.12.0 is affected by allocation of resources without limits or throttling (CVSS 6.5).
Race condition in vLLM's prompt embedding loader allows concurrent API requests to bypass the sparse tensor invariant gu
Exploit-DB