Skip to content
fr Sign in
7.5 High

CVE-2026-41523 vLLM is an inference and serving engine for large language models (LLMs)

Description

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0.

Affected products and versions

Product Affected versions Fixed in
vllm 0.22 earliest → < 0.22.0 0.22.0
Red Hat AI Inference Server Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat AI Inference Server 3.2 1787884873 earliest → < 1787884873 1787884873
Red Hat AI Inference Server 3.2 1782951244 earliest → < 1782951244 1782951244
Red Hat AI Inference Server 3.4 1787151774 earliest → < 1787151774 1787151774
Red Hat AI Inference Server 3.3 1787161803 earliest → < 1787161803 1787161803
Red Hat Enterprise Linux AI 3.4 1787244006 earliest → < 1787244006 1787244006
Show the other branch
Product Affected versions Fixed in
Red Hat Enterprise Linux AI 3.3 1788260620 earliest → < 1788260620 1788260620

References

Timeline

  1. Published
  2. Last modified

Other CVEs of vllm

The 121 CVEs of vllm →
CVE-2026-115918 vLLM is an inference and serving engine for large language models 6.5 Medium CVE-2026-115917 vLLM is an inference and serving engine for large language models 3.4 Low CVE-2026-115916 vLLM is an inference and serving engine for large language models 6.5 Medium CVE-2026-115915 vLLM is an inference and serving engine for large language models 8.1 High
Track this CVE