Security Advisories · vllm-project/vllm · GitHub

Security Advisories

View known security vulnerabilities and report new vulnerabilities privately to maintainers.

Report a vulnerability

API key authentication vulnerable to timing attack
GHSA-wr9h-g72x-mwhm published Oct 7, 2025 by russellb

High
Resource-Exhaustion (DoS) through chat_template / chat_template_kwargs in OpenAI-Compatible Server
GHSA-6fvq-23cw-5628 published Oct 7, 2025 by russellb

Moderate
Remote code execution in the vllm tool call parser for Qwen3-Coder
GHSA-79j6-g2m3-jgfw published Aug 20, 2025 by russellb

High
Server-Side Request Forgery (SSRF) in `MediaConnector`
GHSA-3f6c-7fw2-ppm4 published Oct 7, 2025 by russellb

High
HTTP header size limits not enforced, allowing DoS from unauthenticated requests
GHSA-rxc4-3w6r-4v47 published Aug 20, 2025 by russellb

High
DoS via Malformed pattern and type Fields in vLLM Tool Schema
GHSA-vrq3-r879-7m65 published May 28, 2025 by russellb

Moderate
Remote Code Execution via PyNcclPipe Communication Service
GHSA-hjq4-87xh-g4fv published May 20, 2025 by russellb

Critical
A series of simple Redos in vllm.
GHSA-j828-28rj-hfhp published May 28, 2025 by russellb

Moderate
clients can crash the openai server with invalid regex
GHSA-9hcf-v7m4-6m2j published May 28, 2025 by russellb

Moderate
Weakness in MultiModalHasher Image/video Hashing Implementation in vLLM
GHSA-c65p-x677-fgj6 published May 28, 2025 by russellb

Moderate