Multiple vLLM Vulnerabilities Disclosed Affecting Versions 0.10.2 to 0.31.0

• •Three vulnerabilities in vLLM versions 0.10.2 to 0.31.0 disclosed today.
• •Vulnerabilities include memory exhaustion, DoS attacks, and cross-tenant issues.
• •No active exploitation reported; users should prioritize patching.

Three vulnerabilities in vLLM versions 0.10.2 to 0.31.0 have been disclosed, affecting users of the library. The first vulnerability allows for memory exhaustion via media_io_kwargs num_frames override (CWE-770). The second vulnerability enables a denial-of-service (DoS) attack through a Nemotron-VL Processor decompression bomb guard bypass (CWE-400). Lastly, a cross-tenant DoS vulnerability exists due to uninitialized logprobstensors. These vulnerabilities impact various versions of vLLM, with the earliest affected version being 0.10.2 and the latest being 0.31.0. No has been reported as of now, but users are advised to prioritize patching. GitHub Security Advisory GHSA-4m6g-h9mv-wqjc and GHSA-mm38-5g96-7j6x provide more details on the vulnerabilities.