---
title: "vLLM API changes, deprecations and deadlines | Harbyn"
description: "vLLM: 0 upcoming deadlines and 16 recorded changes as of 2026-10-25, each with its source."
canonical: "https://harbyn.com/vendors/vllm"
last-updated: 2026-10-25
---

# vLLM: API changes and deadlines

Markdown version of <https://harbyn.com/vendors/vllm>.

AI models and APIs. 0 upcoming deadlines, 16 recorded changes. Every entry cites the vLLM page we read it from.

## What we read

The vLLM pages and feeds our ingestion visits, politely and on a schedule.

- **Releases**: <https://api.github.com/repos/vllm-project/vllm/releases?per_page=20>
- **Changelog**: <https://api.github.com/advisories?affects=vllm&per_page=20&sort=published&direction=desc>

## What the scanner looks for

How `harbyn scan` recognises vLLM in a repository, on your machine. Nothing leaves it.

- **Packages**: `pypi vllm`

## Upcoming deadlines

No upcoming vLLM deadline in the feed right now.

## Change history

Newest first, by the date vLLM announced it. This is the archive: past changes are not warnings, and changes we recorded after they took effect are marked as such.

### October 2026

- Oct 23, 2026, Security: [DoS via unvalidated mm\_processor\_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)](https://github.com/advisories/GHSA-gx7p-2j49-hfq4)
- Oct 23, 2026, Security: [Forged multimodal UUIDs can crash the inference engine](https://github.com/advisories/GHSA-p92p-rxj5-7p2x)
- Oct 6, 2026, Security: [Mirrored multimodal IPC caches desync after a rejected request, so a later request with the same media hash crashes the engine core](https://github.com/advisories/GHSA-ph3r-5jfg-f84f)
- Oct 5, 2026, Security: [Loose cache\_salt validation lets one request kill EngineCore on LMCache-MP deployments (denial of service)](https://github.com/advisories/GHSA-2823-qmq8-rwvj)
- Oct 5, 2026, Security: [Flash late-interaction scoring caches query embeddings under a caller-controlled request id, breaking /score and /rerank integrity](https://github.com/advisories/GHSA-2phq-3phc-84px)
- Oct 5, 2026, Security: [Structured-output request errors escape the request boundary and terminate the shared EngineCore (denial of service)](https://github.com/advisories/GHSA-85xf-c7hm-whqw)
- Oct 5, 2026, Security: [Scale-out disaggregated multimodal transport trusts caller-supplied features](https://github.com/advisories/GHSA-ph72-cqr5-qpp7)
- Oct 5, 2026, Security: [Qwen2-VL / Qwen3-VL video samplers are bounded by request-controlled max\_frames, which the num\_frames ceiling does not reach](https://github.com/advisories/GHSA-x6mc-67gf-chw4)

### September 2026

- Sep 17, 2026, Security: [Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation](https://github.com/advisories/GHSA-8pw2-6jv3-mj5j)
- Sep 16, 2026, Security: [Unauthenticated audio decompression-bomb DoS in /v1/chat/completions](https://github.com/advisories/GHSA-hcwq-8wjf-3gcr)
- Sep 8, 2026, Security: [SSRF and local file read in the MiMoV2Omni image and audio loaders bypass MediaConnector protections](https://github.com/advisories/GHSA-4hhp-h66f-j5j7)
- Sep 8, 2026, Security: [Cross-User Data Leak Vulnerability](https://github.com/advisories/GHSA-7m6h-x95x-82q5)
- Sep 4, 2026, Security: [ReDoS via structured\_outputs.regex in the lm-format-enforcer backend](https://github.com/advisories/GHSA-48jh-3gj7-fg8v)
- Sep 4, 2026, Security: [Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds](https://github.com/advisories/GHSA-8737-qx52-hjff)
- Sep 4, 2026, Security: [Unauthenticated Internal Path and Username Disclosure via Validation Error Messages](https://github.com/advisories/GHSA-hwrm-c4cx-rf4j)
- Sep 4, 2026, Security: [Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts](https://github.com/advisories/GHSA-pr7f-p5mw-fc87)