vllm
vllm 0.29.0 · pkgs/development/python-modules/vllm/default.nix
Health
Risk
risk 68 critical
- +60 7 open advisories
- +8 NIXPKGS-2026-2598 has a public exploit (CISA)
Version
0.29.0 no newer release known to repology
Channels
Hydra
succeeded 1d ago
Advisories
NIXPKGS-2026-2651 high 8.7 EPSS 0.8% vLLM through 0.29.0 Memory Exhaustion via Rejected Requests · #564522
CVE-2026-93436
NIXPKGS-2026-2713 high 8.7 EPSS 0.6% vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata · #565749
CVE-2026-94622
NIXPKGS-2026-2622 medium 6.9 EPSS 0.7% vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumption · #564232
CVE-2026-92220
NIXPKGS-2026-2598 medium 5.3 public exploit EPSS 0.5% vllm-project vLLM Jinja Template Rendering completions resource consumption · #563857
CVE-2026-90878
NIXPKGS-2026-2923 medium 5.3 EPSS 0.3% vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach · #571252
CVE-2026-105758
NIXPKGS-2026-2662 medium 6.3 EPSS 0.2% vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs · #564857
CVE-2026-93841
NIXPKGS-2026-2693 low 2.3 EPSS 0.2% vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words · #565537
CVE-2026-93989
NIXPKGS-2026-2663 vllm: CVE-2026-93592 and CVE-2026-93840 fixed in master needs backport to nixos-26.05
NIXPKGS-2026-2617 vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions fixed in master needs backport to nixos-26.05
Packaging
meta complete
Packagewhat each field means
Description
High-throughput and memory-efficient inference and serving engine for LLMs
License
Platforms
31 platforms: Linux, Darwin · not on
aarch64-linux, aarch64-darwinMain program
vllmSource provenance
not set: built from source
Outputs
out distStatus
not broken, not insecure, free
Maintainers
Version bumps 1all open bumps
vllm: 0.24.0 -> 0.30.0
#567745 by r-ryantm · opened 2w ago
Pull requests 6
python3Packages.flashinfer-jit-cache: init at 0.6.17
#574632 by GaetanLepage · opened 1d ago · checks pass
cudaPackages.nvtx: build from source; python3Packages.nvtx: init at 0.2.16; cudaPackages.rmm: use nvtx
#573836 by ConnorBaker · opened 3d ago · checks pass
vllm: 0.24.0 -> 0.30.0
#567745 by r-ryantm · opened 2w ago
python3Packages.vllm-metal: init at 0.3.0-unstable-2026-08-24 draft
#553128 by maxbrunet · opened 2mo ago · checks pass
Closed or merged in the synced window 10
python3Packages.vllm: fix not propagating environ in model reg
#572239 by amarshall · merged 5d ago
vllm: 0.28.0 -> 0.29.0
#571401 by liberodark · merged 7d ago
vllm: 0.24.0 -> 0.26.0
#570513 by liberodark · merged 10d ago
python3Packages.vllm: set mainProgram
#557690 by maxbrunet · merged 6w ago
python3Packages.vllm: tidy dependencies
#557539 by maxbrunet · merged 6w ago
vllm: mark as broken when buildint on aarch64-linux or with cudaSupport
#553566 by GaetanLepage · merged 2mo ago
python3Packages.flashinfer-python: rename from flashinfer
#552305 by Airzh1124 · merged 2mo ago
vllm: 0.26.0 -> 0.28.0
#549327 by GaetanLepage · merged 10d ago
Issues 1
vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach 1.severity: security
#571252 by nixpkgs-security-tracker · opened 9d ago · 0 comments
Closed or merged in the synced window 4
vllm: security issues < 0.29.0 1.severity: security
#567655 by nixpkgs-security-tracker · closed 3d ago · 1 comments
vllm: CVE-2026-93592 and CVE-2026-93840 1.severity: security
#564858 by nixpkgs-security-tracker · closed 3d ago · 1 comments
vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions 1.severity: security
#564227 by nixpkgs-security-tracker · closed 3d ago · 1 comments
vllm: security issues < 0.28.0 1.severity: security
#562846 by nixpkgs-security-tracker · closed 3d ago · 2 comments