vLLM CVE-2026-103241

Requires a vLLM deployment (up to 0.26.0) whose request/response path is processed by the Gemma4UnifiedParser - i.e., serving a Gemma-family model with tool-calling / structured-output parsing that exercises rust/src/parser/src/unified/gemma4.rs. The concrete trigger is input containing delimiter nesting exceeding the parser's stack capacity (repeated '{...}' or '[...]' structures), which recurses without a depth guard until the stack is exhausted. Per CVSS 4.0 the vector is remote and needs no privileges or user interaction (AV:N/PR:N/UI:N). LIMITING FACTORS: the vulnerable code path is specific to the Gemma4 unified parser, so deployments not using that parser/model are unaffected; impact is confined to availability (no data exposure or code execution); and network reachability to the inference endpoint is required, which is often segmented behind gateways or API-key auth in production (auth level not confirmed from the provided data).

This is a genuine but moderate-priority availability issue, not a high-CVSS-but-hollow finding. Multiple exploitation signals are POSITIVE: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, no-privilege, no-interaction trigger; a public POC exists (a GitHub gist), the E:P (Proof-of-Concept) exploit-maturity metric corroborates this; and a vendor patch is available (v0.29.1rc0, commit 3439bad3). What tempers the risk: the ONLY impact is denial of service - VC:N/VI:N (no confidentiality or integrity), with VA:L (partial availability) per the vendor. The root cause (per the PR diff) is unbounded parser recursion on deeply nested delimiters, guarded now by a MAX_PARSER_RECURSION_DEPTH=128 limit; before the fix, sufficiently nested input drives the Rust parser to stack exhaustion. NOTE A DIVERGENCE: the vendor scored availability as VA:L (partial), but a Rust stack overflow aborts the whole process, which would take down the entire vLLM serving instance for all clients - I assess this closer to full availability loss (see assessed vectors). No CISA KEV listing and no EPSS score were provided, so there is no evidence of active mass exploitation despite public POC availability - treat POC availability and active exploitation as distinct signals. Net: a realistic, easily-triggered DoS against exposed vLLM endpoints, meriting prompt patching but not emergency escalation.

An attacker with network reach to a vLLM OpenAI-compatible endpoint that routes output through the Gemma4 unified tool-call parser submits a request whose parsed content contains deeply nested delimiters (repeated '{' or '[' structures). The parser recurses once per nesting level with no depth bound, exhausting the thread stack and aborting the Rust process, denying service to all clients. A public proof-of-concept exploit has been published as a GitHub gist, lowering the bar to reproduce.