CVE-2026-105775
mediumA security vulnerability has been detected in vllm-project vLLM up to 0.31.0.
A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/model_executor/layers/mamba/mamba_mixer2.py of the component Completions Request Handler. The manipulation leads to out-of-bounds read. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/vllm-project/vllm/ cna@vuldb.com
- https://github.com/vllm-project/vllm/issues/57266 cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-105775 cna@vuldb.com
- https://vuldb.com/submit/992291 cna@vuldb.com
- https://vuldb.com/vuln/413808 cna@vuldb.com
- https://vuldb.com/vuln/413808/cti cna@vuldb.com