On October 20, 2026, vLLM published CVE-2026-115915: its ImageMediaIO loader handed incoming bytes to Pillow’s format autodetection with no allowlist, so an EPS file labeled image/png reached the host’s Ghostscript binary and could execute commands. Anyone hosting a multimodal inference server should upgrade to 0.32.0 and restrict inputs to raster formats.
On October 7, 2026, JFrog disclosed CVE-2026-105192, an unauthenticated remote code execution flaw rated 9.8 in LMCache, the cache layer that speeds up LLM servers such as vLLM, with no fix available. If your LMCache cache listens on a routable address, isolate it now instead of waiting for a patch.
Ollama, vLLM, and llama.cpp cover every local inference scenario, from a developer laptop to a GPU cluster. This guide compares real-world throughput, VRAM requirements, and the cost of each approach — so you know which one to deploy by the end of the day.
