Security Advisories · vllm-project/vllm · GitHub

Security Advisories

View known security vulnerabilities and report new vulnerabilities privately to maintainers.

Report a vulnerability

vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cache
GHSA-rm76-4mrf-v9r8 published Feb 6, 2025 by russellb

Low
Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching
GHSA-4qjh-9fv9-r85r published May 28, 2025 by russellb

Low
Malicious model to RCE by torch.load in hf_model_weights_iterator
GHSA-rh4j-5rhw-hr54 published Jan 27, 2025 by russellb

High