← fix library

Why it matters

Your vLLM version is in the affected range for an RCE in the video-processing path of multimodal endpoints. It applies to servers actually serving a video model — and it works even if you set an API key, because the vulnerable code runs before authentication.

Fix it: 2 steps

1. Upgrade vLLM to 0.14.1 or later and rebuild/restart the serving container.
2. If you serve no video model you are outside the affected path, but still upgrade — and keep the API off the public IP (see the 'vLLM API open to the internet' card).

Verify it’s fixed

curl -m 5 http://127.0.0.1:8000/version  # version must be >= 0.14.1

References

• https://github.com/vllm-project/vllm/security/advisories/GHSA-4r2x-xpjr-7cvv
• https://nvd.nist.gov/vuln/detail/CVE-2026-22778

CVE mapping behind this card: human-verified, last checked 2026-07-29.