Skip to content
AI Security Wire

Published

- 4 min read

By

vLLM 0.32.0 Fixes Pickle RCE Path and Ghostscript Risk in 8 Advisories

vLLM CVE-2026-115912 CVE-2026-115915 LLM inference deserialization
img of vLLM 0.32.0 Fixes Pickle RCE Path and Ghostscript Risk in 8 Advisories

vLLM has published eight security advisories covering its OpenAI-compatible server and multimodal paths. GitHub published them on October 28, 2026; NVD records for three we checked show an earlier October 26 publication. Every one lists 0.32.0 as the first fixed version. Two are rated high by GitHub.

What was published

The scores below are GitHub’s, which NVD labels secondary. NVD’s own primary scores for three of them are higher; see the FAQ.

  • CVE-2026-115912 (CVSS 3.1 7.5, CWE-502): a forged shared-memory handle reaches pickle.loads() in a worker.
  • CVE-2026-115915 (8.1, CWE-20 and CWE-183): the image loader can pass an EPS file to Ghostscript.
  • CVE-2026-115918 (6.5): the /v1/responses endpoint skips the trust check on request-supplied chat templates.
  • CVE-2026-115911 (6.5): an unbounded Jinja2 template render can wedge chat endpoints.
  • CVE-2026-115914 (6.5): a DeepSeek-OCR image request can crash the server.
  • CVE-2026-115913 (6.5): the Phi-4 multimodal audio encoder retains full attention matrices.
  • CVE-2026-115916 (6.5): an out-of-vocabulary token id triggers a CUDA assert that poisons the engine.
  • CVE-2026-115917 (3.4): permissive default CORS origins.

We read the advisory text and did not run any proof of concept. Impact statements are the reporters’ claims.

The pickle path

The CVE-2026-115912 advisory, rated high by GitHub, applies only when vLLM runs with --mm-processor-cache-type shm. In that mode a cached multimodal item is represented by an address and a monotonic id. The advisory says the worker treats that pair as authority to read shared memory, and that a public scale-out route decodes caller-supplied features.kwargs_data without authenticating the handle.

The reporter’s chain used three routes: one to obtain a valid feature envelope, one to stage attacker-chosen bytes in the ring buffer, and one to submit a forged inner handle pointing at those bytes. The worker then unpickles them. The advisory says this works without VLLM_ALLOW_INSECURE_SERIALIZATION=1, and describes the caller as authenticated. The 7.5 score carries high attack complexity and low privileges required.

The Ghostscript path

CVE-2026-115915 is a different shape of problem. According to the advisory, ImageMediaIO hands image bytes to Pillow’s format autodetection without a format allowlist, so the declared MIME type does not decide which decoder runs. An EPS payload labeled image/png reached the host’s Ghostscript executable.

The advisory is explicit about limits. Code execution needs a host Ghostscript affected by CVE-2024-29510 (upstream fixed it in 10.03.1). The reporter tested vLLM 0.30.0 only, while the GitHub range is below 0.32.0. The reporter reproduced execution at the loader level on Debian Ghostscript 10.03.0 with a harmless marker command, and traced the HTTP path in source without exercising it end to end. It does not claim a new Ghostscript flaw.

The denial-of-service cluster

Four of the remaining advisories are availability problems and one is a gate bypass. The Responses API bypass (CVE-2026-115918) matters because it combines with the template-render issue (CVE-2026-115911). That advisory says a single request of under 100 bytes can stall every chat-style endpoint on a replica until restart. That applies to non-harmony models with the render worker count at its default of 1 and no --chat-template set, and the Responses gap makes it reachable from an ordinary authenticated client in that configuration. The DeepSeek-OCR advisory (CVE-2026-115914) says one schema-valid PNG sent to a server hosting a DeepSeek-OCR family model can kill it under default configuration. The Phi-4 advisory (CVE-2026-115913) says the audio encoder runs in eager mode by default and keeps full attention matrices in memory, so a single maximum-length audio clip can exhaust resources. The token-id advisory (CVE-2026-115916) says a pre-tokenized prompt with an id equal to the vocabulary size passes validation for models whose vocabulary is a multiple of 64, such as the Llama-2 family at 32000, and then trips a CUDA assert at tensor-parallel size 1. These are the reporters’ descriptions. We did not test them.

The CORS advisory notes that vLLM performs no authentication unless --api-key is set. The v0.32.0 release notes say CORS no longer allows every origin by default.

What to do

  • Upgrade to vLLM 0.32.0 or later.
  • If you cannot upgrade, check whether you use the shm multimodal cache, and avoid exposing the server without --api-key.
  • Check the Ghostscript version on inference hosts that accept image input.
  • On servers older than 0.32.0, restrict CORS origins instead of relying on the wildcard default.

Our assessment: authentication requirements differ. CVE-2026-115912, -115911 and -115918 are described as needing an authenticated caller. The advisories for CVE-2026-115914 and -115913 describe unauthenticated requests, GitHub’s own scores for them say PR:L, and NVD’s primary score for CVE-2026-115915 is PR:N. Since vLLM enforces no authentication unless --api-key is set, exposed servers should be treated as reachable by any client that can connect.

References

Frequently Asked Questions

Which vLLM versions are affected and what is the fix?
Per the GitHub advisories, all eight CVEs (CVE-2026-115911 to CVE-2026-115918) affect vLLM releases before 0.32.0, and 0.32.0 is the first patched version. Some ranges start later, for example 0.16.0 for the Responses API template bypass and 0.19.0 for the Jinja rendering denial of service. GitHub shows v0.32.0 as published on October 18, 2026, ten days before the advisories.
Is any of this being exploited?
We found no evidence of exploitation as of October 29, 2026 in the CISA KEV JSON feed (none of CVE-2026-115911 to CVE-2026-115918 appear in the feed as we checked it) or in the GitHub advisory pages. The CISA-ADP SSVC entries on the NVD records for CVE-2026-115912 and CVE-2026-115915, timestamped October 26, list exploitation as none, automatable as no and technical impact as total. That is an absence of evidence in two sources, not proof that nobody is exploiting them. The reporters describe lab reproductions.
Who scored the CVEs?
It depends on the CVE. GitHub, acting as CNA, supplied scores for all eight, which NVD lists as secondary. For three, NVD ([email protected]) added its own primary scores that differ: CVE-2026-115912 is 8.8 (GitHub 7.5, which rates attack complexity high; NVD rates it low), CVE-2026-115915 is 9.8 (GitHub 8.1) and CVE-2026-115917 is 4.7 (GitHub 3.4). The other five (CVE-2026-115911, -115913, -115914, -115916 and -115918) carry only GitHub's 6.5. The body of this article quotes GitHub's scores unless it says otherwise.