vLLM 0.31.0 ships, and six security holes close

Request-controlled mm_processor_kwargs.code_revision allows remote code execution vllm-project/vllm

A request sets mm_processor_kwargs.code_revision and the server fetches and executes that revision, so anyone who can reach the OpenAI-compatible endpoint can run code on the host. Upgrade to v0.31.0 for the fix, and treat an exposed vLLM instance as untrusted until you do.

SSRF via X-Request-Id header drives P2pNcclConnector outbound ZMQ+NCCL pair, leaking KV-cache tensors vllm-project/vllm

The X-Request-Id header drives the P2pNcclConnector outbound ZMQ+NCCL pair, which lets a caller steer server-side requests and leak KV-cache tensors. Rebuilding on v0.31.0 closes the path.

Unvalidated stop_token_ids causes engine crash (DoS) and out-of-bounds GPU write vllm-project/vllm

stop_token_ids went unvalidated, so a single malformed request crashes the engine and can write out of bounds on the GPU. If you generate token id lists from user input or a proxy, cap and validate them now; v0.31.0 fixes the underlying check.

MOSS-Audio request-controlled processor cache permits remote memory exhaustion vllm-project/vllm

The MOSS-Audio processor cache is keyed on the request, so a caller can force unbounded allocation until the server runs out of memory. v0.31.0 is the fix; in the meantime there is no request-level mitigation the advisory offers.

An oversized min_tokens in one request hangs the vLLM engine while /health stays green vllm-project/vllm

One request with a min_tokens larger than the remaining context wedges the engine, and /health keeps answering green on a dead server. That makes liveness probes useless for detecting this failure, so watch request latency or restart on stall until v0.31.0 is deployed.

Cross-tenant DoS via uninitialized LogprobsTensors with prompt_logprobs vllm-project/vllm

With prompt_logprobs enabled, uninitialized LogprobsTensors are returned to callers, letting one tenant read another's memory contents. Enable prompt_logprobs only for trusted traffic, and upgrade to v0.31.0.

v0.31.0 vllm-project/vllm

by khluu

717 commits from 307 contributors, with DeepSeek-V4.1-Flash as the headline: FlashMLA mega attention with the V4.1 NVFP4 compressed KV cache is now the SM100 default, and the release notes describe DeepGEMM sparse MQA logits for the indexer. It is also the version that carries the security fixes above, which is the reason to move rather than the performance numbers.

[Bugfix][Frontend] Return streaming errors before the first token vllm-project/vllm

by 1fanwang

Generation failures before the first token were swallowed by the empty-chunk filter, so clients got DONE with no error, exactly as the frontend fix describes. Errors now surface before filtering, which matters to any client that trusted the stream to end honestly.