vLLM closes nine request-path holes in October

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

Unauthenticated requests can hang, corrupt, or execute code on default vLLM 0.31.x deployments; 0.31.0 and 0.32.0 also shipped.

3909 commits 3885 PRs merged 316 releases 34 security advisories 31 briefings covered

all local-llm reviews →

← previous month local-llm wire →

Request-controlled mm_processor_kwargs.code_revision allows remote code execution vllm-project/vllm

A request-supplied mm_processor_kwargs.code_revision lets a client point multimodal processing at arbitrary code, and the advisory ranks it as remote code execution. Anyone serving multimodal models to untrusted callers should treat this as the reason to move off 0.31.x.

Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled vllm-project/vllm

A forged public multimodal shared-memory handle reaches worker-side pickle.loads() even with insecure serialization disabled. The existing setting does not cover this path, so disabling it was never the mitigation it looked like.

DeepSeek-OCR family: an image whose normalized pixels sum to exactly 0 makes embed_multimodal return None, tripping the encoder-output sanity assert — one unauthenticated request kills the whole vLLM vllm-project/vllm

For the DeepSeek-OCR family, an image whose normalized pixels sum to exactly 0 makes embed_multimodal return None and trips the encoder-output sanity assert. Under the default config one unauthenticated request takes down the whole engine, which is a cheap denial of service for any public deployment.

SSRF via X-Request-Id header drives P2pNcclConnector outbound ZMQ+NCCL pair, leaking KV-cache tensors vllm-project/vllm

The X-Request-Id header drives P2pNcclConnector into an outbound ZMQ and NCCL pair, so a crafted header turns the server into an SSRF primitive that leaks KV-cache tensors. Only deployments running the P2P connector are in the blast radius, and they should turn it off or patch.

An oversized min_tokens in one request hangs the vLLM engine while /health stays green vllm-project/vllm

A single request with an oversized min_tokens hangs the engine while /health keeps reporting green. Health-check-driven restarts and load balancers will keep routing traffic to a stuck process.

Cross-tenant DoS via uninitialized LogprobsTensors with prompt_logprobs vllm-project/vllm

Uninitialized LogprobsTensors returned to prompt_logprobs callers leak across tenants and give one client a denial of service against another. The unvalidated stop_token_ids report lands in the same bucket: an engine crash plus an out-of-bounds GPU write.

v0.32.0 vllm-project/vllm

by khluu

The month's second vLLM release, 814 commits from 363 contributors, adds the POST /v1/systemone endpoint for choice, noul and score questions over structured state and serves it by default. It also drops the deprecated IR knob and patches GLM-5.3 weight loss, so the upgrade is worth taking after the security fixes.

v0.7.0 ggml-org/llama.cpp

by github-actions[bot]

llama.cpp v0.7.0 adds a GPU cache for MoE experts kept in host memory via --moe-cache-mib, which the release notes put at up to ~2.2x decode speedup when experts are offloaded, alongside LiliCorr speculative decoding and MTP for GLM5-Next. Alongside, MLX ported the Metal gather_qmm wins to CUDA (one benchmark, gemma4 26b, reported +23% on qwen3-coder 30B incremental at p512) and fixed an mlx so...

$ ls local-llm/month/ # the briefings behind this review

Thu Oct 1 MLX ports Metal gather_qmm wins to CUDA, heads-up on a qmm_sm80 corruption bug Fri Oct 2 Qwen4Exp MTP lands in llama.cpp as SGLang ships v0.5.21 Sat Oct 3 llama.cpp spec sampling goes probabilistic, vLLM trims GLM-5.3 attention overhead Sun Oct 4 OpenVINO 2026.4.1 lands in llama.cpp, vLLM frees CUDA graph memory on sleep Mon Oct 5 vLLM 0.31.0 ships DeepSeek-V4.1-Flash kernels, streaming errors stop vanishing behind DONE Tue Oct 6 vLLM's request-controlled caches, and Vulkan sparse attention for quantized K/V Wed Oct 7 vLLM's multimodal input path is remote code execution, and MLX's sort is silently wrong Thu Oct 8 Ollama drops the CLI account step, MLX fixes foreign buffer ownership Fri Oct 9 vLLM drops compile-based sequence parallelism, llama.cpp fixes slot checkpoints and a silent CUDA fallback Sat Oct 10 vLLM's unauthenticated DoS surface, and a 1.9x SYCL MXFP4 lift Sun Oct 11 MiniCPM-V 4.7 lands in llama.cpp, vLLM fixes KV reservation under pressure Mon Oct 12 vLLM patches ZMQ socket exhaustion and CORS defaults, Ollama moves decision models into llama.cpp Tue Oct 13 Metal MoE fix for duplicate ids, sglang stops crashing on retracted DeepSeek-V4 Wed Oct 14 llama.cpp server stack overflow, Ollama brings Metal kernels to CUDA Thu Oct 15 llama.cpp lands GDN chunked kernels and SYCL IQ3 reorder Fri Oct 16 llama.cpp 0.7.0 ships MoE host cache, ollama reaps orphaned Windows runners Sat Oct 17 Streamed tool calls get 200x faster in vLLM; llama.cpp learns proxies Sun Oct 18 vLLM v0.32.0 lands system-one endpoint; Ollama exposes template_source Mon Oct 19 sglang v0.5.22 lands, MLX fixes M1/M2 SDPA Tue Oct 20 Ollama stops leaking canceled requests upstream, llama.cpp hardens big-endian paths Wed Oct 21 Five vLLM crash and forgery paths, realtime transcription lands in llama.cpp Thu Oct 22 Ollama streams real errors, llama.cpp forwards sampling params on /v1/messages Fri Oct 23 Ollama fixes cloud metadata for every launcher, MLX speeds 6-16 row decode ~3x Sat Oct 24 Ollama preps Phonon voice input, vLLM drops deprecated IR knob Sun Oct 25 MoE expert masking lands across every llama.cpp backend Mon Oct 26 Metal grid truncation fixed, vLLM patches GLM-5.3 weight loss Tue Oct 27 Ollama fixes OpenCode v2 launch, llama.cpp rewrites CPU concat as one kernel Wed Oct 28 LFM3 lands across llama.cpp and Ollama, vLLM fields four security fixes Thu Oct 29 llama.cpp lands SYCL DPAS flash attention, Ollama repairs Responses history Fri Oct 30 Faster Metal MXFP4 decode, a GLM-4.7 streaming parser stall fixed Sat Oct 31 Deterministic top-p under TP, KV constants stay on the GPU

all local-llm reviews →

← previous month local-llm wire →