CVE catalog
CVE-2026-105754
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the featu
- Severity
- Medium · CVSS 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.27% · Oct 25, 2026
A flaw was found in vLLM. The scale-out inference service fails to properly validate caller-supplied multimodal parameters, such as image geometry and cache identifiers, against the active model's configuration. An authenticated remote attacker can exploit this vulnerability by submitting crafted feature data to the generation endpoint, terminating the shared engine process and causing a Denial of Service (DoS). In addition, this issue may allow attackers to poison or retrieve shared multimodal cache state across different user requests. vllm: vllm: Denial of Service via unvalidated multimodal parameters in scale-out endpoint A MODERATE severity flaw was found in vLLM, the LLM inference and serving engine shipped in Red Hat AI Inference Server and Red Hat OpenShift AI. In the disaggregated scale-out path, the /inference/v1/generate endpoint accepts caller-supplied multimodal parameters, including tensors in the features.kwargs_data field, cache identifiers in the features.mm_hashes field, placeholder ranges in the features.mm_placeholders field, and wire-selected multimodal field processors, without validating or rebinding them to the active model's renderer contract. An authenticated remote attacker can submit crafted feature data, such as forged grid geometry, field types, or non-positive placeholder lengths, which can terminate the shared EngineCore process and cause a denial of service of the inference service. If an attacker knows or can induce a victim's content hash, forged cache hashes can also poison or retrieve cross-request encoder-cache state. Red Hat rates the impact as MODERATE with a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), matching the upstream assessment. Because this issue is of moderate impact with a CVSS score below 7.0, fixes for the affected Red Hat AI Inference Server and Red Hat OpenShift AI releases are deferred; the residual risk is that an authenticated remote attacker can crash the shared inference engine and disrupt service for all users, or manipulate shared multimodal encoder-cache state across requests. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | vllm | Not reported | 0.30.0 | fixed |
| PyPI | vllm | Not reported | 0.0.1 | vulnerable |
| PyPI | vllm | Not reported | 0.1.0 | vulnerable |
| PyPI | vllm | Not reported | 0.1.1 | vulnerable |
| PyPI | vllm | Not reported | 0.1.2 | vulnerable |
| PyPI | vllm | Not reported | 0.1.3 | vulnerable |
| PyPI | vllm | Not reported | 0.1.4 | vulnerable |
| PyPI | vllm | Not reported | 0.1.5 | vulnerable |
| PyPI | vllm | Not reported | 0.1.6 | vulnerable |
| PyPI | vllm | Not reported | 0.1.7 | vulnerable |
| PyPI | vllm | Not reported | 0.10.0 | vulnerable |
| PyPI | vllm | Not reported | 0.10.1 | vulnerable |
| PyPI | vllm | Not reported | 0.10.1.1 | vulnerable |
| PyPI | vllm | Not reported | 0.10.2 | vulnerable |
| PyPI | vllm | Not reported | 0.11.0 | vulnerable |
| PyPI | vllm | Not reported | 0.11.1 | vulnerable |
| PyPI | vllm | Not reported | 0.11.2 | vulnerable |
| PyPI | vllm | Not reported | 0.12.0 | vulnerable |
| PyPI | vllm | Not reported | 0.13.0 | vulnerable |
| PyPI | vllm | Not reported | 0.14.0 | vulnerable |
| PyPI | vllm | Not reported | 0.14.1 | vulnerable |
| PyPI | vllm | Not reported | 0.15.0 | vulnerable |
| PyPI | vllm | Not reported | 0.15.1 | vulnerable |
| PyPI | vllm | Not reported | 0.16.0 | vulnerable |
| PyPI | vllm | Not reported | 0.17.0 | vulnerable |
| PyPI | vllm | Not reported | 0.17.1 | vulnerable |
| PyPI | vllm | Not reported | 0.18.0 | vulnerable |
| PyPI | vllm | Not reported | 0.18.1 | vulnerable |
| PyPI | vllm | Not reported | 0.19.0 | vulnerable |
| PyPI | vllm | Not reported | 0.19.1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.0 | vulnerable |
| PyPI | vllm | Not reported | 0.2.1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.1.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.2 | vulnerable |
| PyPI | vllm | Not reported | 0.2.3 | vulnerable |
| PyPI | vllm | Not reported | 0.2.4 | vulnerable |
| PyPI | vllm | Not reported | 0.2.5 | vulnerable |
| PyPI | vllm | Not reported | 0.2.6 | vulnerable |
| PyPI | vllm | Not reported | 0.2.7 | vulnerable |
| PyPI | vllm | Not reported | 0.20.0 | vulnerable |
| PyPI | vllm | Not reported | 0.20.1 | vulnerable |
| PyPI | vllm | Not reported | 0.20.2 | vulnerable |
| PyPI | vllm | Not reported | 0.21.0 | vulnerable |
| PyPI | vllm | Not reported | 0.22.0 | vulnerable |
| PyPI | vllm | Not reported | 0.22.1 | vulnerable |
| PyPI | vllm | Not reported | 0.23.0 | vulnerable |
| PyPI | vllm | Not reported | 0.24.0 | vulnerable |
| PyPI | vllm | Not reported | 0.25.0 | vulnerable |
| PyPI | vllm | Not reported | 0.25.1 | vulnerable |
| PyPI | vllm | Not reported | 0.26.0 | vulnerable |
| PyPI | vllm | Not reported | 0.27.0 | vulnerable |
| PyPI | vllm | Not reported | 0.27.1 | vulnerable |
| PyPI | vllm | Not reported | 0.28.0 | vulnerable |
| PyPI | vllm | Not reported | 0.29.0 | vulnerable |
| PyPI | vllm | Not reported | 0.3.0 | vulnerable |
| PyPI | vllm | Not reported | 0.3.1 | vulnerable |
| PyPI | vllm | Not reported | 0.3.2 | vulnerable |
| PyPI | vllm | Not reported | 0.3.3 | vulnerable |
| PyPI | vllm | Not reported | 0.4.0 | vulnerable |
| PyPI | vllm | Not reported | 0.4.0.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.4.1 | vulnerable |
| PyPI | vllm | Not reported | 0.4.2 | vulnerable |
| PyPI | vllm | Not reported | 0.4.3 | vulnerable |
| PyPI | vllm | Not reported | 0.5.0 | vulnerable |
| PyPI | vllm | Not reported | 0.5.0.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.2 | vulnerable |
| PyPI | vllm | Not reported | 0.5.3 | vulnerable |
| PyPI | vllm | Not reported | 0.5.3.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.4 | vulnerable |
| PyPI | vllm | Not reported | 0.5.5 | vulnerable |
| PyPI | vllm | Not reported | 0.6.0 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1.post2 | vulnerable |
| PyPI | vllm | Not reported | 0.6.2 | vulnerable |
| PyPI | vllm | Not reported | 0.6.3 | vulnerable |
| PyPI | vllm | Not reported | 0.6.3.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.4 | vulnerable |
| PyPI | vllm | Not reported | 0.6.4.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.5 | vulnerable |
| PyPI | vllm | Not reported | 0.6.6 | vulnerable |
| PyPI | vllm | Not reported | 0.6.6.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.7.0 | vulnerable |
| PyPI | vllm | Not reported | 0.7.1 | vulnerable |
| PyPI | vllm | Not reported | 0.7.2 | vulnerable |
| PyPI | vllm | Not reported | 0.7.3 | vulnerable |
| PyPI | vllm | Not reported | 0.8.0 | vulnerable |
| PyPI | vllm | Not reported | 0.8.1 | vulnerable |
| PyPI | vllm | Not reported | 0.8.2 | vulnerable |
| PyPI | vllm | Not reported | 0.8.3 | vulnerable |
| PyPI | vllm | Not reported | 0.8.4 | vulnerable |
| PyPI | vllm | Not reported | 0.8.5 | vulnerable |
| PyPI | vllm | Not reported | 0.8.5.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.0 | vulnerable |
| PyPI | vllm | Not reported | 0.9.0.1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.2 | vulnerable |
| PyPI | vllm | Not reported | 0.30.0 | fixed |
| PyPI | vllm | Not reported | 0.0.1 | vulnerable |
| PyPI | vllm | Not reported | 0.1.0 | vulnerable |
| PyPI | vllm | Not reported | 0.1.1 | vulnerable |
| PyPI | vllm | Not reported | 0.1.2 | vulnerable |
| PyPI | vllm | Not reported | 0.1.3 | vulnerable |
| PyPI | vllm | Not reported | 0.1.4 | vulnerable |
| PyPI | vllm | Not reported | 0.1.5 | vulnerable |
| PyPI | vllm | Not reported | 0.1.6 | vulnerable |
| PyPI | vllm | Not reported | 0.1.7 | vulnerable |
| PyPI | vllm | Not reported | 0.10.0 | vulnerable |
| PyPI | vllm | Not reported | 0.10.1 | vulnerable |
| PyPI | vllm | Not reported | 0.10.1.1 | vulnerable |
| PyPI | vllm | Not reported | 0.10.2 | vulnerable |
| PyPI | vllm | Not reported | 0.11.0 | vulnerable |
| PyPI | vllm | Not reported | 0.11.1 | vulnerable |
| PyPI | vllm | Not reported | 0.11.2 | vulnerable |
| PyPI | vllm | Not reported | 0.12.0 | vulnerable |
| PyPI | vllm | Not reported | 0.13.0 | vulnerable |
| PyPI | vllm | Not reported | 0.14.0 | vulnerable |
| PyPI | vllm | Not reported | 0.14.1 | vulnerable |
| PyPI | vllm | Not reported | 0.15.0 | vulnerable |
| PyPI | vllm | Not reported | 0.15.1 | vulnerable |
| PyPI | vllm | Not reported | 0.16.0 | vulnerable |
| PyPI | vllm | Not reported | 0.17.0 | vulnerable |
| PyPI | vllm | Not reported | 0.17.1 | vulnerable |
| PyPI | vllm | Not reported | 0.18.0 | vulnerable |
| PyPI | vllm | Not reported | 0.18.1 | vulnerable |
| PyPI | vllm | Not reported | 0.19.0 | vulnerable |
| PyPI | vllm | Not reported | 0.19.1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.0 | vulnerable |
| PyPI | vllm | Not reported | 0.2.1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.1.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.2 | vulnerable |
| PyPI | vllm | Not reported | 0.2.3 | vulnerable |
| PyPI | vllm | Not reported | 0.2.4 | vulnerable |
| PyPI | vllm | Not reported | 0.2.5 | vulnerable |
| PyPI | vllm | Not reported | 0.2.6 | vulnerable |
| PyPI | vllm | Not reported | 0.2.7 | vulnerable |
| PyPI | vllm | Not reported | 0.20.0 | vulnerable |
| PyPI | vllm | Not reported | 0.20.1 | vulnerable |
| PyPI | vllm | Not reported | 0.20.2 | vulnerable |
| PyPI | vllm | Not reported | 0.21.0 | vulnerable |
| PyPI | vllm | Not reported | 0.22.0 | vulnerable |
| PyPI | vllm | Not reported | 0.22.1 | vulnerable |
| PyPI | vllm | Not reported | 0.23.0 | vulnerable |
| PyPI | vllm | Not reported | 0.24.0 | vulnerable |
| PyPI | vllm | Not reported | 0.25.0 | vulnerable |
| PyPI | vllm | Not reported | 0.25.1 | vulnerable |
| PyPI | vllm | Not reported | 0.26.0 | vulnerable |
| PyPI | vllm | Not reported | 0.27.0 | vulnerable |
| PyPI | vllm | Not reported | 0.27.1 | vulnerable |
| PyPI | vllm | Not reported | 0.28.0 | vulnerable |
| PyPI | vllm | Not reported | 0.29.0 | vulnerable |
| PyPI | vllm | Not reported | 0.3.0 | vulnerable |
| PyPI | vllm | Not reported | 0.3.1 | vulnerable |
| PyPI | vllm | Not reported | 0.3.2 | vulnerable |
| PyPI | vllm | Not reported | 0.3.3 | vulnerable |
| PyPI | vllm | Not reported | 0.4.0 | vulnerable |
| PyPI | vllm | Not reported | 0.4.0.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.4.1 | vulnerable |
| PyPI | vllm | Not reported | 0.4.2 | vulnerable |
| PyPI | vllm | Not reported | 0.4.3 | vulnerable |
| PyPI | vllm | Not reported | 0.5.0 | vulnerable |
| PyPI | vllm | Not reported | 0.5.0.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.2 | vulnerable |
| PyPI | vllm | Not reported | 0.5.3 | vulnerable |
| PyPI | vllm | Not reported | 0.5.3.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.4 | vulnerable |
| PyPI | vllm | Not reported | 0.5.5 | vulnerable |
| PyPI | vllm | Not reported | 0.6.0 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1.post2 | vulnerable |
| PyPI | vllm | Not reported | 0.6.2 | vulnerable |
| PyPI | vllm | Not reported | 0.6.3 | vulnerable |
| PyPI | vllm | Not reported | 0.6.3.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.4 | vulnerable |
| PyPI | vllm | Not reported | 0.6.4.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.5 | vulnerable |
| PyPI | vllm | Not reported | 0.6.6 | vulnerable |
| PyPI | vllm | Not reported | 0.6.6.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.7.0 | vulnerable |
| PyPI | vllm | Not reported | 0.7.1 | vulnerable |
| PyPI | vllm | Not reported | 0.7.2 | vulnerable |
| PyPI | vllm | Not reported | 0.7.3 | vulnerable |
| PyPI | vllm | Not reported | 0.8.0 | vulnerable |
| PyPI | vllm | Not reported | 0.8.1 | vulnerable |
| PyPI | vllm | Not reported | 0.8.2 | vulnerable |
| PyPI | vllm | Not reported | 0.8.3 | vulnerable |
| PyPI | vllm | Not reported | 0.8.4 | vulnerable |
| PyPI | vllm | Not reported | 0.8.5 | vulnerable |
| PyPI | vllm | Not reported | 0.8.5.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.0 | vulnerable |
| PyPI | vllm | Not reported | 0.9.0.1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.2 | vulnerable |
| PyPI | vllm | Not reported | 0.30.0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | vllm | cpe | Not reported | 0.30.0 | Not reported | NVD-CVE-2026-105754 | Not reported |
| PyPI | vllm | PyPI | Not reported | 0.30.0 | Not reported | PYSEC-2026-4309 | Not reported |
| PyPI | vllm | PyPI | Not reported | 0.30.0 | Not reported | GHSA-PH72-CQR5-QPP7 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://github.com/advisories/GHSA-ph72-cqr5-qpp7]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-105754]
- [https://osv.dev/vulnerability/PYSEC-2026-4309]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105754.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3564.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]