The model is not the only surface: eight flaws reached the inference infrastructure

An AI API can use a well-evaluated model and remain exposed because of the software that receives, transforms, schedules, and distributes requests. In October 2026, eight official vLLM advisories fixed in the 0.32.0 line spanned multimodal processing, templates, validation, CORS, and shared resources. The batch does not prove that every deployment was exploitable. It shows why inventorying only the model leaves a relevant part of the boundary outside review.

Status: Evidence Brief approved for publication. Editorial series: Papers we read for you. This text does not reproduce payloads, vulnerable paths, credentials, targets, or exploitation instructions.

Eight advisories, eight different conditions

The official pages reviewed classify two occurrences as high, five as moderate, and one as low. Affected ranges and prerequisites vary, so this count cannot be converted into a universal vLLM risk rate or a claim that a specific installation was compromised.

The set includes:

1. untrusted EPS image processing with potential denial of service and, under additional host conditions, execution through Ghostscript;
2. a shared multimodal identifier that reached unsafe deserialization in the worker;
3. a permissive CORS origin by default on the HTTP server;
4. materialization of audio attention capable of exhausting memory;
5. OCR image processing capable of consuming resources until the service fails;
6. an out-of-vocabulary token identifier capable of triggering a device failure;
7. passing template arguments on a route that did not honor the expected control;
8. template rendering without a sufficient limit, capable of exhausting the execution pool.

The advisories were published by the project itself. This is primary evidence of acknowledged conditions and fixed versions; it is not independent observation of exploitation in production.

Updating is necessary, but the affected range must be checked advisory by advisory

Version 0.32.0 is listed as the fix on all eight pages reviewed. Even so, the update decision should not be based only on the phrase ‘fixed in 0.32.0.’ The team must verify the effective package and image versions, enabled features, compatibility, behavior changes, and the exact artifact to be promoted.

An image named latest, a transitive package or an unpatched node may preserve the condition after the change has been announced. The remediation receipt should identify the image digest, dependencies, configuration, and relevant test results.

The surface is larger than the text-generation route

Multimodal inputs can invoke decoders, native libraries, and external tools. The template layer transforms data before the model. CORS, authentication, proxies, and request limits belong to the server. Queues, shared memory, and workers distribute the effect across processes. None of these elements appears in the model weights.

This does not mean every company must expose every modality. The simplest way to reduce the surface is to disable what is not part of the product: unused formats, endpoints, templates, and integrations should not remain accessible for convenience.

A verifiable remediation contract

This contract is a professional proposal. It was not tested by the maintainers in the format above and does not turn the Evidence Brief into certification of a deployment.

Proportional controls

• update to a compatible fixed version and verify the digest actually deployed;
• restrict formats and modalities to the set required by the product;
• keep authentication, authorization, CORS, and limits outside the model's decision;
• isolate processes that interpret media and avoid unnecessary external tools in the runtime;
• limit size, duration, depth, concurrency, time, and memory before expensive execution;
• test controlled failure, restart, degradation, and rollback without using real data or targets;
• monitor rejections and usage by identity without recording sensitive prompts or files by default;
• track new advisories and reopen the review when the image, dependency, or configuration changes.

In the Forge canon, isolation, minimum identity, and provenance are complementary controls; none replaces the others. This architecture guidance does not show that a specific product has adopted them or that it eliminates the condition described by the advisories. [R2-C3]

Limits and conflicts of interest

The eight records were published by the affected project and describe its own fix. This is the most direct source for affected ranges and remediation, but it is not independent testing of the fix across all architectures. CUDA versions, drivers, operating systems, models, plugins, and topology may change exposure and impact.

The severities are those displayed by the advisories at the editorial cutoff. CVSS helps with triage but does not replace context: a disabled modality and a public server do not have the same risk path. At the cutoff, we found no public evidence of widespread exploitation of these eight occurrences. Lack of public evidence does not prove lack of exploitation.

Trustyu and Tech Human did not participate in the discovery, fix, or maintenance of vLLM. The cases were not independently reproduced in this analysis. The recommendations are professional interpretation and must be adapted to the environment by people with legitimate authority and access.

Architecture rule

An AI service is a software system: model, server, libraries, formats, workers, identities, network, and operations. Risk review must follow this chain. Changing the model without reviewing the infrastructure may preserve the exact surface that caused the incident.

Direct sources

1. vLLM v0.32.0, official release.
2. GHSA-h3rc-j82p-2c3h, EPS processing.
3. GHSA-6757-hggm-hp2w, multimodal shared memory.
4. GHSA-vvpg-rrww-wpmh, CORS.
5. GHSA-8397-8qf6-f2gm, audio attention.
6. GHSA-gq5q-89c7-vhvx, OCR processing.
7. GHSA-q97c-p368-75c4, token validation.
8. GHSA-x567-49g5-p4cf, template arguments.
9. GHSA-542m-9234-8gvf, rendering exhaustion.

Editorial and responsibility note

This text combines facts attributed to sources with the author's analysis and technical proposal. Personal and professional viewpoints are not proven facts; severities, versions, conditions, and limitations are identified when available. The content is informative and does not replace technical, legal, regulatory, or security assessment. vLLM, GitHub, products, and cited institutions belong to their respective owners; there is no sponsorship or endorsement. No offensive procedure is reproduced. Tech Human and Trustyu commercially provide digital product development and governance. Research, structure, and writing were assisted by AI; Fernando Parreiras authorized the topic, factual self-review, and publication on 29 October 2026, without additional independent human review.

Research cutoff: 29 October 2026. Editorial status: special Evidence Brief authorized for 30 October 2026 at 09:00 BRT.