vllm-project vLLM

• CVE-2025-66448 High 7.1 vLLM vulnerable to remote code execution via transformers_utils/get_config 0.7%
• CVE-2025-62372 High 8.3 vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs 0.4%
• CVE-2025-62426 Medium 6.5 vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs` 0.5%
• CVE-2025-62164 High 8.8 VLLM deserialization vulnerability leading to DoS and potential RCE 1.0%
• CVE-2025-59425 High 7.5 vLLM vulnerable to timing attack at bearer auth 0.6%
• CVE-2025-48956 High 7.5 vLLM API endpoints vulnerable to Denial of Service Attacks 0.6%
• CVE-2025-48944 Medium 6.5 vLLM Tool Schema allows DoS via Malformed pattern and type Fields 0.6%
• CVE-2025-48943 Medium 6.5 vLLM allows clients to crash the openai server with invalid regex 0.5%
• CVE-2025-48942 Medium 6.5 vLLM DOS: Remotely kill vllm over http with invalid JSON schema 0.6%
• CVE-2025-48887 Medium 6.5 vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py` 0.5%
• CVE-2025-46722 Medium 4.2 vLLM has a Weakness in MultiModalHasher Image Hashing Implementation 0.3%
• CVE-2025-46570 Low 2.6 vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel 0.4%
• CVE-2025-47277 Critical 9.8 vLLM Allows Remote Code Execution via PyNcclPipe Communication Service 1.0%
• CVE-2025-30165 High 8.0 Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration 0.6%
• CVE-2025-32444 Critical 10.0 vLLM Vulnerable to Remote Code Execution via Mooncake Integration 1.8%
• CVE-2025-46560 Medium 6.5 vLLM phi4mm: Quadratic Time Complexity in Input Token Processing​ leads to denial of service 0.5%
• CVE-2025-30202 High 7.5 Data exposure via ZeroMQ on multi-node vLLM deployment 0.6%
• CVE-2025-29783 Critical 9.1 vLLM Allows Remote Code Execution via Mooncake Integration 0.7%
• CVE-2025-29770 Medium 6.5 vLLM denial of service via outlines unbounded cache on disk 0.5%
• CVE-2025-25183 Low 2.6 vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cache 0.2%
• CVE-2025-24357 High 7.5 vLLM allows a malicious model RCE by torch.load in hf_model_weights_iterator 0.9%