Zero Radar
← feed
HighVulnerabilityupdated 27 Oct 2026, 12:23 UTC

vLLM AI server has several flaws allowing code execution and denial of service

vLLM is software for running AI language models on servers. Several security holes could let an attacker run their own code on the server, crash it, see data it should not, or bypass safety checks.

Official source
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official sourceBacked by an official source

What happened

Multiple vulnerabilities in vLLM enable arbitrary code execution, denial of service, information disclosure and security control bypass. The updated advisory rates the overall risk high, with one related denial-of-service item rated medium.

Why it is dangerous: A successful attacker could take control of the server running vLLM or make the AI service unavailable, and could expose information processed by the model. Organizations hosting vLLM for AI inference are at risk.

Are you affected?

You are affected if you run vLLM for serving AI models, as the advisory does not list specific versions or configurations.

vLLM (specific versions not stated in the material)

What to do

  1. Check whether vLLM is installed or used in your environment and identify its version
  2. Check the CERT-Bund (BSI) advisory ZR-64d911ec for the fixed version and apply the vendor update as soon as it is available
  3. Restrict network access to vLLM services and do not expose them directly to the internet until patched

Timeline

  1. 27 Oct 2026, 11:33 UTC
    Publicly disclosed
  2. 27 Oct 2026, 11:33 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  3. 27 Oct 2026, 11:37 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 12:17 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
ZR-64d911ec
Disclosed
27 Oct 2026, 11:33 UTC
On Zero Radar
27 Oct 2026, 11:37 UTC (5 min after disclosure)
Last change
27 Oct 2026, 12:23 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

vLLM AI server has several flaws allowing code execution and denial of service · Zero Radar