Vllm: improper input validation

At a glance

Vllm: Amber, patch this week. vLLM has a vulnerability in its ImageMediaIO that allows an attacker to pass malicious image bytes to Pillow, potentially leading to code execution or resource exhaustion. An attacker could exploit this to execute commands with the vLLM process's privileges.

The flaws

• CVE-2026-116174: Improper input validation (CVSS 7.5 · EPSS 0%)
• CVE-2026-115915: VLLM is an inference and serving engine for large language models (CVSS 9.8 · EPSS 1%)
• CVE-2026-94624: Vllm p2p never connected zmq_exhaustion (CVSS 7.5 · EPSS 1%)
• CVE-2026-100652: Improper input validation (CVSS 7.5 · EPSS 0%)

The fix

Upgrade Vllm: 0.24.0 · 0.32.0 or later on your release line

Who is exposed: {'products': ['vLLM'], 'packages': [], 'versions': ['prior to 0.32.0']}

Where it stands

• Public proof of concept

Connects to

• Same weakness: CWE-183 (CWE-183). 4 other warnings in 30 days
• Same product: Earlier Vllm warnings. 34 in the last 90 days