Vulnerability Reportlmcache/vllm-openai:v0.5.5

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. The most impactful exposed issues, CVE-2026-58012 and CVE-2026-58013 in GLib, could let an attacker crash the inference server or leak a handful of bytes of process memory by feeding crafted strings into regex replacement or custom line-terminator handling, disrupting service availability for anything relying on this endpoint. Enforcing a network policy that blocks untrusted inbound traffic to the serving port removes the remote attack path for these GLib over-reads entirely. Note that CVE-2026-0861 only bites if attacker-controlled size and alignment values reach the memalign family, and the DANE TLSA use-after-free (CVE-2026-28387) applies only to clients doing DANE TLSA server authentication with mixed PKIX and DANE-TA records, neither of which is part of the standard vLLM OpenAI serving path.