{"action":"Upgrade vllm to 0.19.1 or later.","affected":[{"fixed":"0.19.1","introduced":"0"}],"component":"vllm","cve_ids":["CVE-2026-7141"],"ecosystem":"PyPI","epss":0.00478,"exploited":false,"fixed_versions":["0.19.1"],"ghsa_id":"GHSA-x368-4g9h-fvv4","id":"tcs_01M5KGYNT4CBX3GVSPYA7V763M","modified_at":"2026-07-13T16:45:11.279169812Z","published_at":"2026-04-27T17:16:45.637Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2306","https://vuldb.com/submit/801297","https://vuldb.com/vuln/359740","https://github.com/vllm-project/vllm/issues/39146","https://github.com/vllm-project/vllm/issues/39146#issue-4215090365","https://vuldb.com/vuln/359740/cti","https://github.com/AjAnubolu/vllm/commit/1ad67864c0c20f167929e64c875f5c28e1aad9fd","https://github.com/vllm-project/vllm/pull/39283","https://github.com/advisories/GHSA-x368-4g9h-fvv4"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-2306","url":"https://osv.dev/vulnerability/PYSEC-2026-2306"}],"summary":"A vulnerability was found in vllm up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py of the component KV Block Handler. Performing a manipula"}