- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 14
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
14 assets you may test, 6 excluded.
Web 1
- https://docs.vllm.ai
Products and areas 13
- LoRA adapter loading and the multi-adapter serving path, including where an adapter is fetched from
- Model loading across safetensors, GGUF and PyTorch checkpoint formats, along with the remote code execution flag on models fetched from a hub
- Multimodal input handling for image, video and audio models, which decodes attacker-supplied media in process
- SECURITY.md routes reports to the vulnerability management team through GitHub private advisory reporting, and the published process declares no boundary narrower than the project. Everything below sits inside that
- Speculative decoding, prefix-cache-aware routing and the disaggregated prefill paths
- The CLI, the entrypoints and the configuration parsing in front of the engine
- The distributed execution layer: the worker-to-worker transport, the collective communication backend and every control channel between engine processes
- The KV cache, prefix caching and any cross-request state that persists between one caller's request and another's
- The metrics, health and server info endpoints and what each exposes about loaded models and adapters
- The OpenAI-compatible API server: the chat, completions, embeddings, tokenisation and pooling endpoints, and the request parsing and validation behind each
- The Ray and Kubernetes integrations the project ships, and the plugin and custom executor interfaces
- The tokenizer and chat template rendering, which evaluates a Jinja template that arrives with the model
- Tool calling, structured output and guided decoding, covering the grammar and schema parsing each performs on request input
Out of scope (6)
- A deployment deliberately run with remote code execution enabled against an untrusted model
- Model weights and their provenance, which the operator chooses to trust or not
- Prompt injection, jailbreaks and output content, which are model behaviour rather than engine defects
- PyTorch, transformers, CUDA and other upstream dependencies, unless vLLM's own use of them is what makes the defect reachable
- Ray as a project, which has its own security process and its own paid huntr history
- Resource consumption within limits the operator configured
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report through GitHub private vulnerability reporting on vllm-project/vllm , which reaches the Vulnerability Management Team.
-
Give the serving command, the model and the engine arguments.
-
Say whether the deployment ran single-node or multi-node.
-
Prompt-level model behaviour is not a vulnerability here. Show a defect in the engine's code rather than in what a model was persuaded to say
Not accepted
-
Prompt injection, jailbreaks and output content, which are model behaviour rather than engine defects
-
Resource consumption within limits the operator configured
-
Model weights and their provenance, which the operator chooses to trust or not
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-115914 | vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image is alone in its per-step encoder batch. _parse_and_validate_image_input returns no embedding, embed_mult | Medium 6.5 | 26 Oct 2026 |
| CVE-2026-115915 | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host componen | High 8.1 | 26 Oct 2026 |
| CVE-2026-115916 | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it | Medium 6.5 | 26 Oct 2026 |
| CVE-2026-115917 | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on localhost, an internal network, or a VPN, call endpoints including GET /v1/models and POST /v1/chat/completio | Low 3.4 | 26 Oct 2026 |
| CVE-2026-115918 | vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is configured. ChatParams.get_apply_chat_template_kwargs() preserves that value without enforcing trust_request_chat_template, so the request can | Medium 6.5 | 26 Oct 2026 |
| CVE-2026-115911 | vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by tokenizer.apply_chat_template() without a wall-clock timeout, output-size limit, or iteration bound. Rendering | Medium 6.5 | 26 Oct 2026 |
| CVE-2026-115912 | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution | High 7.5 | 26 Oct 2026 |
| CVE-2026-115913 | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forward_attention to materialize and retain full attention matrices in self.attn. The scaled dot-product attention | Medium 6.5 | 26 Oct 2026 |
| CVE-2026-116179 | vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so VideoMediaIO.load_base64 decodes every frame, exhausting memory and crashing the API frontend. | High 8.7 | 25 Oct 2026 |
| CVE-2026-116180 | vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowE | High 8.3 | 25 Oct 2026 |
| CVE-2026-116181 | vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or write outside the V2 runner's logits buffer. | High 7.1 | 25 Oct 2026 |
| CVE-2026-116172 | vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via CandidateTokens.top_n. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping top_n values to trigger torch.topk failures that terminate EngineCore. | High 8.2 | 25 Oct 2026 |
| CVE-2026-116173 | vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with output_logprobs enabled and more than 128 output_candidates.token_ids, triggering a fatal sampler exception that crashes the engine. | High 8.2 | 25 Oct 2026 |
| CVE-2026-116174 | vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy. | High 8.2 | 25 Oct 2026 |
| CVE-2026-116175 | vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio via input_audio or audio_url in /v1/chat/completions requests that expands to huge decoded PCM, exhausting server memory. | High 7.1 | 25 Oct 2026 |
| CVE-2026-116176 | vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker. | High 8.8 | 25 Oct 2026 |
| CVE-2026-116177 | vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker and deny service to co-tenants. | High 8.7 | 25 Oct 2026 |
| CVE-2026-116178 | vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimodal item with repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists, producing a negative text span in Q | High 8.2 | 25 Oct 2026 |
| CVE-2026-114049 | vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycled batch slots apply their token allowlist to victims' unrestricted requests. | Medium 6.3 | 21 Oct 2026 |
| CVE-2026-114050 | vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted. | High 7.1 | 21 Oct 2026 |
| CVE-2026-114051 | vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart. | High 7.1 | 21 Oct 2026 |
| CVE-2026-114052 | vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process. | High 8.7 | 21 Oct 2026 |
| CVE-2026-114053 | vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint | Critical 9.2 | 21 Oct 2026 |
| CVE-2026-114054 | vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match cache_salt to a LoRA name to reuse first-block KV state. | High 7.1 | 21 Oct 2026 |
| CVE-2026-114055 | vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server. | High 8.7 | 21 Oct 2026 |
| CVE-2026-105922 | A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was | Low 2.1 | 6 Oct 2026 |
| CVE-2026-105758 | vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs.video.fps fields without enforcing server-side ceilings. An unauthenticated caller can submit these values to the /tokenize endpoint, causing the sampler to decod | Medium 5.3 | 5 Oct 2026 |
| CVE-2026-105759 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus's Family::get_or_create function to permane | Medium 5.9 | 5 Oct 2026 |
| CVE-2026-105760 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options without a strict work ceiling. GLMGA constructs and deduplicates an attacker-sized pre-decode frame-index list, allowing a compact request and tiny valid video to con | Medium 5.3 | 5 Oct 2026 |
| CVE-2026-105752 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation prefix in the global unsalted cache namespace even when the caller enabled salting. On deployments with prefix caching enabled, which is the | Low 3.1 | 5 Oct 2026 |
| CVE-2026-105753 | vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if that request is rejected. A later request reusing the same media hash causes MultiModalProcessorSender | Medium 6.5 | 5 Oct 2026 |
| CVE-2026-105754 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm_hashes field, ranges in the features.mm_placeholders field, and wire-selected multimodal field processors without rebinding them to the acti | Medium 6.5 | 5 Oct 2026 |
| CVE-2026-105755 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can overwrite the cached query embedding so the victim's documents are scored against the attacker's query, | Medium 4.2 | 5 Oct 2026 |
| CVE-2026-105756 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise a | Medium 6.5 | 5 Oct 2026 |
| CVE-2026-105757 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust f | Medium 6.5 | 5 Oct 2026 |
| CVE-2026-103241 | A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 0.29.1rc0 is able to resolve this issue. This patch i | Medium 5.5 | 30 Sep 2026 |
| CVE-2026-100650 | vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits). Across four ingress paths — the shared media-acquisition layer (HTTPConnection.get_bytes()/async_get_bytes()), the chat completions audio_url/b | High 7.1 | 26 Sep 2026 |
| CVE-2026-100651 | vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' (multimodal) payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal EngineInput directly from the caller-supplied token_ids, and GenerateRequest.token_ids (vllm/entrypoints/serve/disagg/protocol.py) is not checked a | High 7.1 | 26 Sep 2026 |
| CVE-2026-100652 | vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids to trigger CUDA tensor indexing failures that leave EngineCore in a fatal state requiring service re | High 8.2 | 26 Sep 2026 |
| CVE-2026-100653 | vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast loads in vllm/model_executor/models/funaud | High 8.3 | 26 Sep 2026 |
| CVE-2026-100654 | vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When min_tokens > 0, the stop token ids are used as logits indices to suppress stop tokens, so an out-of-range id reaches a CUDA indexing o | High 7.1 | 26 Sep 2026 |
| CVE-2026-100647 | vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP requests with multi-hundred-megabyte salt values that trigger expensive pickle serialization and SHA-256 | Medium 6.9 | 26 Sep 2026 |
| CVE-2026-100648 | vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decoding. | Medium 6.9 | 26 Sep 2026 |
| CVE-2026-100649 | vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits and exhaust unaccounted GPU memory. | Medium 6.3 | 26 Sep 2026 |
| CVE-2026-94626 | vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel OOM-kill of the decode worker process. | High 8.7 | 21 Sep 2026 |
| CVE-2026-94627 | vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts, causing orphaned KV cache blocks to accumulate until process restart and eventually preventing legitima | High 8.7 | 21 Sep 2026 |
| CVE-2026-94622 | vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kv_transfer_params dictionary entries to trigger an uncaught KeyError in EngineCore scheduling, causing the decode engine to terminate and making all routed requests fail until manual restart. | High 8.7 | 21 Sep 2026 |
| CVE-2026-94623 | vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in NixlBaseConnectorWorker._apply_prefix_caching by submitting completion requests with multiple prompts of va | High 8.7 | 21 Sep 2026 |
| CVE-2026-94624 | vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can supply arbitrary remote host and port values in kv_transfer_params to create unreachable peer sessions that retain ZeroMQ sockets until the context quota is exhausted, causing an uncaught ZMQError that | High 8.7 | 21 Sep 2026 |
| CVE-2026-94625 | vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 480 seconds while health checks continue returning success. | Medium 6.9 | 21 Sep 2026 |
| CVE-2026-93989 | vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests to return incorrect tokens. | Low 2.3 | 19 Sep 2026 |
| CVE-2026-93840 | vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow concurrent requests to sample tokens outside their allowlists. | Medium 6.3 | 18 Sep 2026 |
| CVE-2026-93841 | vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing out-of-bounds writes that corrupt concurrent requests' sampler state and alter repetition penalty be | Medium 6.3 | 18 Sep 2026 |
| CVE-2026-93592 | vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that poisons the GPU context, causing all subsequent requests to fail until the process restarts. | High 8.7 | 18 Sep 2026 |
| CVE-2026-93436 | vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max_tokens=0 to exhaust decode-worker memory without bound until the worker restarts. | High 8.7 | 17 Sep 2026 |
| CVE-2026-69147 | vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.video.video_backend to pynvvideocodec, and MediaConnector.fetch_video forwards that choice to VideoMediaIO even when startup configuration selected a software decoder. The engine's _reserve_mm_ipc_gpu_memory logic budgets decoder memory only | Medium 6.5 | 16 Sep 2026 |
| CVE-2026-57173 | vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v1/chat/completions calls AudioMediaIO.load_bytes or AudioMediaIO.load_file without passing VLLM_MAX_AUDIO_DECODE_DURATION_S to the shared audio decoder. An unauthenticated client can therefore submit a small compressed audio input that expands into a very large float32 PCM alloca | Medium 6.5 | 16 Sep 2026 |
| CVE-2026-90553 | vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False. | High 8.5 | 12 Sep 2026 |
| CVE-2026-90554 | vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In nano_nemotron_vl.py, _extract_audio_from_videos calls load_audio_pyav(BytesIO(video_bytes)) without the max_duration_s or max_decode_bytes parameters, so neither VLLM_MAX_AUDIO_DECODE_DURATION_S nor VLLM_MAX_AUDIO_DECODE_BYTES is enforced (unl | Medium 6.9 | 12 Sep 2026 |
| CVE-2026-90555 | vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants. | High 7.1 | 12 Sep 2026 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 41 Last 12 months 59 Lifetime Deserialization RCE 40 % Access control 25 % Template injection 20 % Parsing/validation 15 % Latest advisories Loading the feed Overview vLLM is the inference engine most production LLM serving runs on, from single-node deployments through to multi-node clusters on GPU hardware. It loads model artifacts, exposes an OpenAI-compatible API, and in distributed mode passes tensors and control messages between worker processes. CVE-2024-9053 is the reference point: unsafe pickle deserialization reaching remote code execution, the class that recurs wherever machine learning infrastructure moves Python objects across a network. vLLM's policy routes reports to its vulnerability management team through GitHub and offers no reward, and huntr currently lists the repository at zero. sorona.xyz pays you directly on qualified, reproduced findings. In scope SECURITY.md routes reports to the vulnerability management team through GitHub private advisory reporting, and the published process declares no boundary narrower than the project. Everything below sits inside that The OpenAI-compatible API server: the chat, completions, embeddings, tokenisation and pooling endpoints, and the request parsing and validation behind each Model loading across safetensors, GGUF and PyTorch checkpoint formats, along with the remote code execution flag on models fetched from a hub The distributed execution layer: the worker-to-worker transport, the collective communication backend and every control channel between engine processes The KV cache, prefix caching and any cross-request state that persists between one caller's request and another's LoRA adapter loading and the multi-adapter serving path, including where an adapter is fetched from Tool calling, structured output and guided decoding, covering the grammar and schema parsing each performs on request input Multimodal input handling for image, video and audio models, which decodes attacker-supplied media in process The tokenizer and chat template rendering, which evaluates a Jinja template that arrives with the model The metrics, health and server info endpoints and what each exposes about loaded models and adapters Speculative decoding, prefix-cache-aware routing and the disaggregated prefill paths The Ray and Kubernetes integrations the project ships, and the plugin and custom executor interfaces The CLI, the entrypoints and the configuration parsing in front of the engine Out of scope Model weights and their provenance, which the operator chooses to trust or not PyTorch, transformers, CUDA and other upstream dependencies, unless vLLM's own use of them is what makes the defect reachable Ray as a project, which has its own security process and its own paid huntr history A deployment deliberately run with remote code execution enabled against an untrusted model Prompt injection, jailbreaks and output content, which are model behaviour rather than engine defects Resource consumption within limits the operator configured Most-valued findings Deserialization reaching code execution, the CVE-2024-9053 shape, anywhere the engine unpickles or otherwise materialises objects that crossed a process or network boundary The distributed execution transport, where a worker accepting control messages or tensors from an unauthenticated peer becomes code execution across the whole serving cluster Chat template rendering, since a Jinja template arriving with a model repository and evaluated at load time is code execution before a single request is served KV cache and prefix caching paths where one request's state influences or leaks into another's response, the multi-tenant failure mode for a shared serving endpoint LoRA adapter loading from a path or URL a request can influence, which turns an inference call into arbitrary artifact loading Guided decoding and structured output grammar handling, a newer surface with untrusted request input driving a parser Multimodal input decoding, which parses attacker-supplied images, video and audio inside the serving process Unauthenticated API endpoints exposing loaded model names, adapters, configuration or metrics that describe a proprietary deployment CVE-2026-41523 and CVE-2026-22778 are the further entries the study records without describing them, which shows the advisory stream is live rather than dormant Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through GitHub private vulnerability reporting on vllm-project/vllm , which reaches the Vulnerability Management Team. The process is documented in SECURITY.md and in the vLLM docs Nothing is paid upstream. huntr lists the repository with every severity tier at zero and the project's own policy mentions no reward Re-verify the huntr state before you start. huntr paid roughly $1,500 for a vLLM RCE in 2024 and the repository is still listed, so the tiers could be re-funded Give the serving command, the model and the engine arguments. A finding usually depends on whether tensor or pipeline parallelism was on and which backend executed Say whether the deployment ran single-node or multi-node. The worker transport between processes is a completely different trust boundary from the API server Prompt-level model behaviour is not a vulnerability here. Show a defect in the engine's code rather than in what a model was persuaded to say Disclosure Coordinated privately with the vLLM vulnerability management team through the GitHub advisory flow, published as a GitHub Security Advisory with a CVE alongside a release. vLLM ships frequently and most deployments track recent versions, so the embargo runs to the advisory and its release rather than to a day count you set. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability