CVE-2026-73559

Katalog CVE

CVSS 6.5 · Medium EPSS 0,58%

Kerentanan Uncontrolled Resource Consumption pada vllm. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded list[str] or list[list[int]], prompt_to_seq() in vllm/renderers/inputs/preprocess.py and OnlineRenderer.preprocess_completion() in vllm/renderers/online_renderer.py expand every element, and vllm/entrypoints/openai/completion/serving.py creates one engine generator and response slot per prompt, allowing an authenticated API client to exhaust CPU, memory, async scheduling capacity, engine request slots, and response buffering with one request. This issue is fixed in version 0.26.0.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

28 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vllm-project/vllm/security/advisories/GHSA-87x5-vmc3-756j exploit · advisory vendor
• https://github.com/vllm-project/vllm/commit/675f4295cdfe0d870471c2b51bfeca3a68a9569e patch
• https://github.com/vllm-project/vllm/pull/47845 issue tracking · patch
• https://github.com/vllm-project/vllm/releases/tag/v0.26.0 release notes