CVE-2026-115915 vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
CriticalCVSS 9.8
EPSS 0.66%
- Published
- Updated
- Exploit status
- No public exploit known
Description
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi vllm(PyPI) | < 0.32.0 | 0.32.0 |
| pypi vllm(PyPI) | = 0.0.1 | No fix listed |
| pypi vllm(PyPI) | = 0.1.0 | No fix listed |
| pypi vllm(PyPI) | = 0.1.1 | No fix listed |
| pypi vllm(PyPI) | = 0.1.2 | No fix listed |
| pypi vllm(PyPI) | = 0.1.3 | No fix listed |
| pypi vllm(PyPI) | = 0.1.4 | No fix listed |
| pypi vllm(PyPI) | = 0.1.5 | No fix listed |
| pypi vllm(PyPI) | = 0.1.6 | No fix listed |
| pypi vllm(PyPI) | = 0.1.7 | No fix listed |
| pypi vllm(PyPI) | = 0.10.0 | No fix listed |
| pypi vllm(PyPI) | = 0.10.1 | No fix listed |
| pypi vllm(PyPI) | = 0.10.1.1 | No fix listed |
| pypi vllm(PyPI) | = 0.10.2 | No fix listed |
| pypi vllm(PyPI) | = 0.11.0 | No fix listed |
| pypi vllm(PyPI) | = 0.11.1 | No fix listed |
| pypi vllm(PyPI) | = 0.11.2 | No fix listed |
| pypi vllm(PyPI) | = 0.12.0 | No fix listed |
| pypi vllm(PyPI) | = 0.13.0 | No fix listed |
| pypi vllm(PyPI) | = 0.14.0 | No fix listed |
| pypi vllm(PyPI) | = 0.14.1 | No fix listed |
| pypi vllm(PyPI) | = 0.15.0 | No fix listed |
| pypi vllm(PyPI) | = 0.15.1 | No fix listed |
| pypi vllm(PyPI) | = 0.16.0 | No fix listed |
| pypi vllm(PyPI) | = 0.17.0 | No fix listed |
Show 104 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi vllm(PyPI) | = 0.17.1 | No fix listed |
| pypi vllm(PyPI) | = 0.18.0 | No fix listed |
| pypi vllm(PyPI) | = 0.18.1 | No fix listed |
| pypi vllm(PyPI) | = 0.19.0 | No fix listed |
| pypi vllm(PyPI) | = 0.19.1 | No fix listed |
| pypi vllm(PyPI) | = 0.2.0 | No fix listed |
| pypi vllm(PyPI) | = 0.2.1 | No fix listed |
| pypi vllm(PyPI) | = 0.2.1.post1 | No fix listed |
| pypi vllm(PyPI) | = 0.2.2 | No fix listed |
| pypi vllm(PyPI) | = 0.2.3 | No fix listed |
| pypi vllm(PyPI) | = 0.2.4 | No fix listed |
| pypi vllm(PyPI) | = 0.2.5 | No fix listed |
| pypi vllm(PyPI) | = 0.2.6 | No fix listed |
| pypi vllm(PyPI) | = 0.2.7 | No fix listed |
| pypi vllm(PyPI) | = 0.20.0 | No fix listed |
| pypi vllm(PyPI) | = 0.20.1 | No fix listed |
| pypi vllm(PyPI) | = 0.20.2 | No fix listed |
| pypi vllm(PyPI) | = 0.21.0 | No fix listed |
| pypi vllm(PyPI) | = 0.22.0 | No fix listed |
| pypi vllm(PyPI) | = 0.22.1 | No fix listed |
| pypi vllm(PyPI) | = 0.23.0 | No fix listed |
| pypi vllm(PyPI) | = 0.24.0 | No fix listed |
| pypi vllm(PyPI) | = 0.25.0 | No fix listed |
| pypi vllm(PyPI) | = 0.25.1 | No fix listed |
| pypi vllm(PyPI) | = 0.26.0 | No fix listed |
| pypi vllm(PyPI) | = 0.27.0 | No fix listed |
| pypi vllm(PyPI) | = 0.27.1 | No fix listed |
| pypi vllm(PyPI) | = 0.28.0 | No fix listed |
| pypi vllm(PyPI) | = 0.29.0 | No fix listed |
| pypi vllm(PyPI) | = 0.3.0 | No fix listed |
| pypi vllm(PyPI) | = 0.3.1 | No fix listed |
| pypi vllm(PyPI) | = 0.3.2 | No fix listed |
| pypi vllm(PyPI) | = 0.3.3 | No fix listed |
| pypi vllm(PyPI) | = 0.30.0 | No fix listed |
| pypi vllm(PyPI) | = 0.31.0 | No fix listed |
| pypi vllm(PyPI) | = 0.4.0 | No fix listed |
| pypi vllm(PyPI) | = 0.4.0.post1 | No fix listed |
| pypi vllm(PyPI) | = 0.4.1 | No fix listed |
| pypi vllm(PyPI) | = 0.4.2 | No fix listed |
| pypi vllm(PyPI) | = 0.4.3 | No fix listed |
| pypi vllm(PyPI) | = 0.5.0 | No fix listed |
| pypi vllm(PyPI) | = 0.5.0.post1 | No fix listed |
| pypi vllm(PyPI) | = 0.5.1 | No fix listed |
| pypi vllm(PyPI) | = 0.5.2 | No fix listed |
| pypi vllm(PyPI) | = 0.5.3 | No fix listed |
| pypi vllm(PyPI) | = 0.5.3.post1 | No fix listed |
| pypi vllm(PyPI) | = 0.5.4 | No fix listed |
| pypi vllm(PyPI) | = 0.5.5 | No fix listed |
| pypi vllm(PyPI) | = 0.6.0 | No fix listed |
| pypi vllm(PyPI) | = 0.6.1 | No fix listed |
| pypi vllm(PyPI) | = 0.6.1.post1 | No fix listed |
| pypi vllm(PyPI) | = 0.6.1.post2 | No fix listed |
| pypi vllm(PyPI) | = 0.6.2 | No fix listed |
| pypi vllm(PyPI) | = 0.6.3 | No fix listed |
| pypi vllm(PyPI) | = 0.6.3.post1 | No fix listed |
| pypi vllm(PyPI) | = 0.6.4 | No fix listed |
| pypi vllm(PyPI) | = 0.6.4.post1 | No fix listed |
| pypi vllm(PyPI) | = 0.6.5 | No fix listed |
| pypi vllm(PyPI) | = 0.6.6 | No fix listed |
| pypi vllm(PyPI) | = 0.6.6.post1 | No fix listed |
| pypi vllm(PyPI) | = 0.7.0 | No fix listed |
| pypi vllm(PyPI) | = 0.7.1 | No fix listed |
| pypi vllm(PyPI) | = 0.7.2 | No fix listed |
| pypi vllm(PyPI) | = 0.7.3 | No fix listed |
| pypi vllm(PyPI) | = 0.8.0 | No fix listed |
| pypi vllm(PyPI) | = 0.8.1 | No fix listed |
| pypi vllm(PyPI) | = 0.8.2 | No fix listed |
| pypi vllm(PyPI) | = 0.8.3 | No fix listed |
| pypi vllm(PyPI) | = 0.8.4 | No fix listed |
| pypi vllm(PyPI) | = 0.8.5 | No fix listed |
| pypi vllm(PyPI) | = 0.8.5.post1 | No fix listed |
| pypi vllm(PyPI) | = 0.9.0 | No fix listed |
| pypi vllm(PyPI) | = 0.9.0.1 | No fix listed |
| pypi vllm(PyPI) | = 0.9.1 | No fix listed |
| pypi vllm(PyPI) | = 0.9.2 | No fix listed |
| pypi vllm(PyPI) | >= 0.30.0, < 0.32.0 | 0.32.0 |
| redhat/rhaii/vllm-cpu-rhel9:1793444554(Red Hat:ai_inference_server:3.5::el9) | All versions | No fix listed |
| redhat/rhaii/vllm-rocm-rhel9:1793444456(Red Hat:ai_inference_server:3.5::el9) | All versions | No fix listed |
| redhat/rhaii/vllm-spyre-rhel9:1793444409(Red Hat:ai_inference_server:3.5::el9) | All versions | No fix listed |
| redhat/rhaii/vllm-gaudi-rhel9:1793444510(Red Hat:ai_inference_server:3.5::el9) | All versions | No fix listed |
| redhat/rhaii/vllm-cuda-rhel9:1793444600(Red Hat:ai_inference_server:3.5::el9) | All versions | No fix listed |
| redhat/rhaii-fast/vllm-cpu-rhel9(Red Hat:ai_inference_server:3) | All versions | No fix listed |
| redhat/rhaii-fast/vllm-cuda-rhel9(Red Hat:ai_inference_server:3) | All versions | No fix listed |
| redhat/rhaii-fast/vllm-gaudi-rhel9(Red Hat:ai_inference_server:3) | All versions | No fix listed |
| redhat/rhaii-fast/vllm-neuron-rhel9(Red Hat:ai_inference_server:3) | All versions | No fix listed |
| redhat/rhaii-fast/vllm-omni-cuda-rhel9(Red Hat:ai_inference_server:3) | All versions | No fix listed |
| redhat/rhaii-fast/vllm-rocm-rhel9(Red Hat:ai_inference_server:3) | All versions | No fix listed |
| redhat/rhaii-fast/vllm-spyre-rhel9(Red Hat:ai_inference_server:3) | All versions | No fix listed |
| redhat/rhaii-fast/vllm-tpu-rhel9(Red Hat:ai_inference_server:3) | All versions | No fix listed |
| redhat/rhaii/vllm-neuron-rhel9(Red Hat:ai_inference_server:3) | All versions | No fix listed |
| redhat/rhaii/vllm-tpu-rhel9(Red Hat:ai_inference_server:3) | All versions | No fix listed |
| redhat/rhelai3/bootc-aws-cuda-rhel9(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/rhelai3/bootc-azure-cuda-rhel9(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/rhelai3/bootc-azure-rocm-rhel9(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/rhelai3/bootc-cuda-rhel9(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/rhelai3/bootc-gaudi-rhel9(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/rhelai3/bootc-gcp-cuda-rhel9(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/rhelai3/bootc-rocm-rhel9(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/rhoai/odh-kserve-storage-initializer-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-llm-d-kv-cache-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-vllm-cuda-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-vllm-rocm-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| vllm-project vllm | = < 0.32.0 | No fix listed |
| vllm | >= 0.30.0, < 0.32.0 | 0.32.0 |
References
- https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-j82p-2c3h patch vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- https://github.com/vllm-project/vllm/pull/60022 patch
- https://github.com/vllm-project/vllm/commit/710ac56e691d4713feca50a43e6c440f07d373fd patch
- github.com product
- https://github.com/vllm-project/vllm/releases/tag/v0.32.0 release-notes vendor-advisory
- Red Hat CVE page mitigation vendor-advisory
- RHSA-2026:94702 patch vendor-advisory
- RHSA-2026:94709 patch vendor-advisory
- RHSA-2026:94717 patch vendor-advisory
- RHSA-2026:94721 patch vendor-advisory
- RHSA-2026:94738 patch vendor-advisory
- Red Hat Bugzilla 2560976 issue-tracking
- www.cve.org
- github.com