CVE-2026-71486

Katalog CVE

CVSS 4.3 · Medium EPSS 0,37%

Kerentanan Uncontrolled Resource Consumption pada vllm. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generate_responses, choices, token_ids, prompt_logprobs, logprobs.content, top_logprobs, and routed_experts structures are processed by OnlineDerenderer and tokenizer.decode before max_model_len, max_tokens, max_num_seqs, or response-size limits are enforced, allowing an authenticated API client to consume excessive CPU and memory and produce oversized responses. This issue is fixed in version 0.26.0.

Rincian

Terbit di NVD

17 Agustus 2026

Terakhir diubah

2 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vllm-project/vllm/security/advisories/GHSA-8737-qx52-hjff exploit · advisory vendor · mitigasi
• https://github.com/vllm-project/vllm/commit/8e61b646e2d157f9b93451fa048f9c8530c8a67b patch
• https://github.com/vllm-project/vllm/pull/47260 issue tracking · patch
• https://github.com/vllm-project/vllm/releases/tag/v0.26.0 release notes