vLLM 0.32.0 security fixes: CVE-2026-115915 (untrusted image bytes can reach Ghostscript via EPS, GHSA-h3rc-j82p-2c3h) and CVE-2026-115912 (forged multimodal shared-memory handles reach pickle.loads, GHSA-6757-hggm-hp2w). Am I affected and what should I do?

What it is: vLLM published two high-severity advisories on October 28, 2026, both fixed in 0.32.0. - CVE-2026-115915: vLLM's image loader let Pillow pick the decoder from the image bytes, ignoring the declared MIME type. An image sent to a multimodal endpoint could therefore be an EPS file, which Pillow hands to the host's Ghostscript. With an old, vulnerable Ghostscript installed (for example one affected by CVE-2024-29510), that can mean command execution as the vLLM process; otherwise it can still cause denial of service. - CVE-2026-115912: with the multimodal processor cache in shared-memory mode (--mm-processor-cache-type shm), an authenticated API caller could forge a cache reference that makes a worker deserialize attacker-supplied bytes with pickle, which means code execution on the worker. This works even without VLLM_ALLOW_INSECURE_SERIALIZATION. Am I affected: - vllm below 0.32.0 (pip show vllm, or the version of the vllm/vllm-openai image). - CVE-2026-115915: you serve a vision/multimodal model and accept images from users, and Ghostscript is installed on the host or in the image (which gs). Without Ghostscript the EPS route can't run code. - CVE-2026-115912: you start vLLM with --mm-processor-cache-type shm and people you don't fully trust can call the API. Fix: 1. Upgrade to vllm 0.32.0 or later (or the matching vllm-openai image) and restart. 2. Until then: remove Ghostscript from inference hosts and images if nothing needs it (or update it to a current release), and don't use --mm-processor-cache-type shm on endpoints reachable by untrusted callers. 3. Keep the OpenAI-compatible server behind authentication (--api-key or a gateway) and off the public internet; run it as a non-root user with only the credentials it needs. Verify: pip show vllm reports 0.32.0+, which gs finds nothing (or a current version) in the serving image, and the server's launch flags no longer include the shm cache type on exposed deployments. Sources: https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-j82p-2c3h https://github.com/vllm-project/vllm/security/advisories/GHSA-6757-hggm-hp2w https://nvd.nist.gov/vuln/detail/CVE-2026-115915 https://github.com/vllm-project/vllm/releases/tag/v0.32.0