VulertSecurity VulertSecurity

Vulnerability Database · PyPI · vllm · Version

vllm 0.29.0

0.29.0 is affected by 53 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 0.32.0.

Critical 6 High 1 Medium 28 Low 2 Unrated 16

All vllm versions & vulnerabilities → Source repository Search the database for this package →
Released 09 Sep 2026 Licence Apache-2.0 Also known from other sources 24 Newer releases 100 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

vllm 0.29.0 vulnerabilities

53 vulnerabilities cover vllm 0.29.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2024-11041: vLLM Remote Code Execution Vulnerability Due to Untrusted Data Deserialization 9.8 critical No fix published 29 Jun 2026
CVE-2024-9052: vLLM Remote Code Execution Vulnerability in GroupCoordinator.recv_object 9.8 critical No fix published 29 Jun 2026
CVE-2024-9053: vLLM Remote Code Execution via Pickle Deserialization 9.8 critical No fix published 20 Mar 2025
CVE-2024-9052: vLLM Remote Code Execution Vulnerability Due to Unsafe Deserialization 9.8 critical No fix published 20 Mar 2025
CVE-2024-11041: vLLM Remote Code Execution Vulnerability Due to Deserialization of Untrusted Data 9.8 critical No fix published 20 Mar 2025
CVE-2024-9053: vllm Remote Code Execution Vulnerability in AsyncEngineRPCServer 9.8 critical No fix published 20 Mar 2025
CVE-2025-30165: Remote Code Execution Vulnerability in vLLM Package 8.0 high No fix published 06 May 2025
CVE-2026-54235: vLLM Temperature Validation Bypass Leading to GPU Kernel Crashes 6.9 medium No fix published 13 Jul 2026
CVE-2026-54235: vLLM Package Temperature Validation Bypass Leading to GPU Crashes 6.9 medium No fix published 17 Jun 2026
CVE-2026-105756: vLLM Denial of Service via Loose Cache Salt Validation 6.5 medium 0.30.0 15 Oct 2026
CVE-2026-105754: vLLM Denial of Service and Integrity Issues via Caller-Supplied Features 6.5 medium 0.30.0 15 Oct 2026
CVE-2026-105754: vLLM Package Suffers from Scale-Out Transport Vulnerability Leading to Denial of Service 6.5 medium 0.30.0 05 Oct 2026
CVE-2026-105757: vLLM EngineCore Denial of Service via Structured-Output Request Errors 6.5 medium 0.30.0 05 Oct 2026
CVE-2026-105756: vLLM Denial of Service via Loose Cache Salt Validation 6.5 medium 0.30.0 05 Oct 2026
CVE-2026-105757: vLLM Package Structured-Output Request Failure Vulnerability 6.5 medium 0.30.0 05 Oct 2026
CVE-2026-54233: vLLM Out-of-Memory Denial of Service via Audio Decompression Bomb 6.5 medium No fix published 13 Jul 2026
CVE-2026-54233: vLLM Out-of-Memory Denial of Service via Audio Decompression Bomb 6.5 medium No fix published 17 Jun 2026
CVE-2024-8939: vLLM Denial of Service via the best_of Parameter 6.2 medium No fix published 07 Jul 2026
Denial of Service Vulnerability in vLLM Package via best_of Parameter 6.2 medium No fix published 17 Sep 2024
CVE-2026-105760: vLLM CPU and Memory Exhaustion via GLMGA Video Sampling 5.3 medium 0.30.0 15 Oct 2026
CVE-2026-105758: vLLM Memory Exhaustion Vulnerability in Qwen Video Samplers 5.3 medium 0.30.0 15 Oct 2026
CVE-2026-105758: vLLM Memory Exhaustion Vulnerability in Qwen Video Samplers 5.3 medium 0.30.0 05 Oct 2026
CVE-2026-105760: vLLM Video Sampling Vulnerability Leading to CPU and Memory Exhaustion 5.3 medium 0.30.0 05 Oct 2026
CVE-2026-93841: vLLM Memory Corruption Vulnerability in Triton Kernel 5.3 medium 0.30.0 18 Sep 2026
CVE-2026-53923: vLLM Information Disclosure Vulnerability Due to Integer Truncation in GGUF Dequantize Kernel 5.3 medium No fix published 13 Jul 2026
CVE-2026-9540: vllm Denial of Service Vulnerability Due to Improper Resource Shutdown 5.3 medium No fix published 13 Jul 2026
CVE-2026-53923: vLLM Information Disclosure via GGUF Dequantize Kernel Integer Truncation 5.3 medium No fix published 17 Jun 2026
CVE-2026-9540: vllm Denial of Service Vulnerability Due to Improper Resource Shutdown 5.3 medium No fix published 26 May 2026
CVE-2026-12491: vLLM EXIF Orientation and PNG Transparency Handling Vulnerability 4.8 medium No fix published 13 Jul 2026
EXIF and PNG Transparency Handling Vulnerability in vLLM: Mismatch Between Model Input and Expectations 4.8 medium No fix published 17 Jun 2026
CVE-2026-12491: vLLM Image Processing Vulnerability Leading to Orientation and Transparency Issues 4.8 medium No fix published 17 Jun 2026
CVE-2026-93989: vLLM Token Index Validation Flaw Leading to Logits Memory Corruption 4.3 medium 0.30.0 19 Sep 2026
CVE-2026-105755: vLLM Cross-Request Integrity Break via Caller-Controlled Request ID 4.2 medium 0.30.0 05 Oct 2026
CVE-2026-105755: vLLM Package Vulnerability Leading to Query Overwrite 4.2 medium 0.30.0 05 Oct 2026
CVE-2026-105752: vLLM Package Vulnerability Leading to Cross-Tenant Cache Leakage 3.1 low 0.30.0 15 Oct 2026
CVE-2026-105752: vLLM Package Vulnerability Leading to Cross-Tenant Cache Membership Oracle 3.1 low 0.30.0 06 Oct 2026
CVE-2026-105922: Denial of Service Vulnerability in vllm Package N/A unrated 0.32.0 06 Oct 2026
CVE-2026-100650: vLLM Denial of Service Vulnerability Due to Inadequate Media Control Enforcement N/A unrated 0.30.0 26 Sep 2026
CVE-2026-94626: vLLM Memory Exhaustion Vulnerability Due to tp_size Parameter Validation Failure N/A unrated 0.30.0 21 Sep 2026
CVE-2026-94625: vLLM Resource Exhaustion Vulnerability in MooncakeConnector N/A unrated 0.30.0 21 Sep 2026
CVE-2026-94624: vLLM Denial of Service Vulnerability in P2P KV Offloading N/A unrated 0.30.0 21 Sep 2026
CVE-2026-94623: vLLM Denial of Service Vulnerability in NIXL Connector N/A unrated 0.30.0 21 Sep 2026
CVE-2026-94622: vLLM Denial of Service Vulnerability in NIXL Connector Metadata Handling N/A unrated 0.30.0 21 Sep 2026
CVE-2026-93436: vLLM Memory Exhaustion Vulnerability Due to Improper Metadata Cleanup N/A unrated 0.30.0 17 Sep 2026
CVE-2026-54236: vLLM Incomplete Fix Leaks Memory Addresses via Anthropic API Router N/A unrated No fix published 13 Jul 2026
CVE-2026-54236: vLLM Incomplete Fix Leaks Memory Addresses via Anthropic API Router N/A medium No fix published 17 Jun 2026
CVE-2025-48943: vllm Denial of Service Vulnerability Due to Invalid Regex Input N/A unrated 08bf7840780980c7568c573c70a6a8db94fd45ff 30 May 2025
CVE-2025-48942: vllm Package Server Crash Due to Invalid JSON Schema in Completions API N/A unrated 08bf7840780980c7568c573c70a6a8db94fd45ff 30 May 2025
CVE-2025-48887: vLLM Regular Expression Denial of Service Vulnerability N/A unrated 4fc1bf813ad80172c1db31264beaef7d93fe0601 30 May 2025
CVE-2025-46570: vllm Package Suffers from Timing Attack Vulnerability N/A unrated 77073c77bc2006eb80ea6d5128f076f5e6c6f54f 29 May 2025
CVE-2025-46722: vllm Package Image Hashing Vulnerability Leading to Data Integrity Issues N/A unrated 99404f53c72965b41558aceb1bc2380875f5d848 29 May 2025
CVE-2025-29783: vLLM Remote Code Execution Vulnerability Due to Unsafe Deserialization N/A unrated 288ca110f68d23909728627d3100e5a8db820aa2 19 Mar 2025
CVE-2025-25183: vLLM Cache Collision Vulnerability Leading to Unintended Behavior N/A unrated 432117cd1f59c76d97da2eaff55a7d758301dbc7 07 Feb 2025

Looking for another version, or everything Vulert holds for vllm?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About vllm 0.29.0

Is vllm 0.29.0 vulnerable?

Yes. 53 vulnerabilities in the Vulert database cover vllm 0.29.0: 6 critical, 1 high, 28 medium and 2 low, plus 16 not yet rated. The upgrade Vulert recommends is 0.32.0, and each entry above names the fixed version to move to.

Which version of vllm should I use instead of 0.29.0?

0.32.0 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 0.29.0 the latest release of vllm?

No. 0.29.0 was published 09 Sep 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor vllm for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the vllm version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.