CVE-2026-105775

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.31.1

Description A remote out-of-bounds read can occur within the Completions Request Handler component. The issue resides in the conv ssm forward() function located in the vllm/model executor/layers/mamba/mamba mixer2.py file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the conv ssm forward() function.