vLLM v0.32.0 fixes three API-reachable denial-of-service flaws and ships four breaking changes: no CORS by default, Python 3.11, pinned Transformers.
vLLM v0.32.0, released on 18 October 2026, fixes three denial-of-service flaws that an API client can trigger, and ships four breaking changes that will stop some deployments from starting or from serving browser clients. The release covers 814 commits from 363 contributors and follows vLLM v0.31.0. Teams that expose vLLM to untrusted or semi-trusted clients should upgrade for the fixes, but should plan for the breaking changes first.
The security fixes
The release notes list three GitHub security advisories. All three flaws are reached through the API.
Chat template resource exhaustion (PR #50300). According to the pull request, unbounded Jinja2 template rendering let an authenticated API client wedge all chat-style endpoints by exhausting CPU or memory. The patch rejects a user-supplied chat_template in the chat_template_kwargs of /v1/responses, adds static validation of the template's syntax tree, and adds a render timeout (VLLM_CHAT_TEMPLATE_RENDER_TIMEOUT). The Rust frontend gets a 500K instruction budget per render. The advisory reference the release notes give for this fix does not match GitHub's advisory record, which describes a different, older bug, so we cite the fix by its pull request and give no advisory id, CVE or severity for it.
GHSA-q97c-p368-75c4, tokenizer max_token_id off-by-one (PR #59491). The Hugging Face tokenizer wrapper reported vocab_size, which is a count, as the largest valid token id, when the largest valid id is one less. A prompt containing the id equal to vocab_size therefore passed validation, and at tensor-parallel size 1 the embedding lookup can fail with a CUDA device-side assert. The pull request says the vLLM security team rated it moderate.
GHSA-frvg-qw88-hww9, P2P ZMQ socket exhaustion (PR #51504). A client could submit many unique, non-listening peer addresses through kv_transfer_params. Each one created three ZMQ sockets that were never cleaned up, and about 340 such peers reached the 1023-socket limit and crashed EngineCore. The fix caps peer sessions (VLLM_P2P_MAX_PEERS, default 128), adds a handshake deadline (VLLM_P2P_HANDSHAKE_TIMEOUT_S, default 30 seconds) and evicts idle peers (VLLM_P2P_IDLE_TIMEOUT_S, default 300 seconds).
No public advisory page or CVE id for the second and third advisories was available when we checked.
Breaking changes
- CORS default is now none. The default allowed origin changed from
*to none. Browser clients that call vLLM directly will fail until you set--allowed-origins. - Python 3.11 minimum. Python 3.10 is no longer supported.
- Pinned Transformers.
transformers>=5.16.1,<5.20.0andtokenizers>=0.23.2are required. - Cascade attention removed.
--disable-cascade-attnstill parses but only prints a warning, and it goes away in v0.33.0. Drop it from launch scripts now.
Four launch settings that change in vLLM v0.32.0, what breaks, and the fix for each.
What else is new
The NVFP4 KV cache now runs on SM8x, SM12x and SM90 GPUs. The release adds EmbeddingGemma 2 (google/embeddinggemma-2), an embedding model for text, image, audio and video, and --limit-mm-per-prompt can now skip encoders for modalities a deployment does not use.
What to do
- Move the Python runtime to 3.11 or later, and pin
transformers>=5.16.1,<5.20.0. - If a browser talks to vLLM directly, set
--allowed-originsexplicitly and keep the list narrow. - Remove
--disable-cascade-attnfrom launch scripts. - If you use P2P KV transfer, review the three
VLLM_P2P_*limits against the size of your fleet. - Keep vLLM endpoints behind authentication and a gateway, since all three flaws are triggered by API clients.