Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

vllm-project/vllm

              main @ 84c2f9f
            

198

Fixes

CVEs

CRITICAL

Peak severity

11.1%

Coverage

Highlights

Denial of Service: 142 prior fixes. Scrutinize any change in this area.

vllm/entrypoints/openai/api_server.py: most-fixed (9 issues). Treat as high-risk during review.

79 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Unchecked loading of Hugging Face dynamic auto_map modules and configurations without verifying user trust settings (trust_remote_code) allows malicious model repositories to execute arbitrary code during model initialization. Assertions protecting model architectures are also easily bypassed if Python runs in optimized mode.

Deserialization of Untrusted Data: Distributed components (e.g. Mooncake integrations and IPC weight transfer utilities) historically used insecure Python pickle deserialization over unauthenticated TCP sockets. This allows unauthenticated remote attackers on adjacent networks to achieve remote code execution on cluster worker nodes.

Denial of Service: Lack of strict range and type boundaries on sampling parameters such as 'n', 'best_of', 'temperature', and token IDs enables attackers to craft inputs that exhaust GPU/CPU memory or trigger illegal memory access faults in Triton and CUDA kernels, crashing the inference engine.