The report
An inference server exposes more than a model's prompt parser. Browser origins, image preprocessors, audio attention, chat templates and API route adapters each interpret requests before or after inference. Five vLLM advisories demonstrate separate ways that interpretation can cross an authorization or resource boundary.
Different inputs, different failures
| Affected surface | Reported failure | Important prerequisite |
|---|---|---|
| HTTP CORS | An unrelated web origin could send requests to a reachable unauthenticated local server | Broad allowed origins and no effective API-key requirement |
| DeepSeek-OCR | A valid balanced black-and-white image could produce a zero-sum tensor mistaken for absent embedding data | Specific OCR preprocessing path |
| Phi-4 audio | A permitted ten-minute WAV could exhaust roughly 24 GiB of GPU memory | Affected audio encoder and limited VRAM |
| Jinja renderer | A short adversarial chat template could occupy the renderer indefinitely | Attacker-controlled template or model configuration, not plain chat text alone |
| Responses API | Nested template kwargs reached rendering despite a request-template trust prohibition | Exposed Responses route with the affected option flow |
The CORS advisory does not bypass an enabled API token. The audio advisory demonstrates memory exhaustion from valid input, not an exploit hidden in a corrupted file. The template-policy advisory can connect to the separately demonstrated renderer problem, but their mechanisms and CVEs remain distinct.
What an upgrade proves
All five disclosures identify vLLM 0.32.0 as the fixed release. A successful package update is necessary but does not answer whether all serving endpoints, origins and selected models share the same policy. A useful test submits equivalent inputs through Chat and Responses routes, alternates anonymous and authenticated browser requests, and measures error containment so one user's legal audio or image does not kill other users' inference jobs.
No documented production campaign follows from these controlled advisory reproductions. Their value is the concrete separation of input validation, execution-time resource budgeting and caller authorization.