vLLM phi4mm: Quadratic Time Complexity in Input Token Processing​ leads to denial of service

Data exposure via ZeroMQ on multi-node vLLM deployment

vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

vLLM: Downmix Implementation Differences as Attack Vectors Against Audio AI Models

vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`

vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs

vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

vLLM DeepSeek-OCR image processing vulnerable to denial of service

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool

vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids

vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions

vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys

vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids

vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass

vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization

vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

vLLM before 0.28.0 Denial of Service via Audio Header

vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

vLLM: Completion prompt lists fan out into unbounded engine requests

vLLM denial of service via prompt embeds on M-RoPE models

vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit

vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors

vLLM: OOM Denial of Service via Audio Decompression Bomb

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters

vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing

vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs

vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`

vLLM Tool Schema allows DoS via Malformed pattern and type Fields

vLLM allows clients to crash the openai server with invalid regex

vLLM DOS: Remotely kill vllm over http with invalid JSON schema

vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`

vLLM denial of service via outlines unbounded cache on disk

vLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url `

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding

vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs

vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids