vLLM
CVE-2026-105757
MEDIUM
GHSA-85xf-c7hm-whqw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain access to vLLM inference API
-
DeliverySubmit crafted structured-output request
-
ExploitEscape request-scoped validation
-
ExecutionReach EngineCore fatal-error path
-
ImpactCrash shared engine (service-wide DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Requires the ability to submit structured-output / constrained-generation requests to a running vLLM server (PR:L - request-submission access to the inference endpoint, not anonymous unless the endpoint is exposed without auth). Three distinct triggers each suffice: (1) a per-request structured-output backend mismatch that re-raises a grammar compilation exception; (2) the ngram_gpu speculative-decoding mode being enabled, whose -1 padding passes a negative token id to llguidance validation (this path is limited to deployments configured with speculative decoding via ngram_gpu); and (3) the Rust frontend accepting empty structured-output values that the Python frontend would reject. Limiting factors: impact is denial of service only (no code execution, no data exposure); the engine must be running structured-output/guided-decoding features; and affected versions are those prior to 0.30.0. The shared-engine design means a single request affects all co-tenants. |
| Impact | This is a moderate-severity, availability-only denial-of-service flaw, not a high-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent: network-reachable, low-complexity, requiring low privileges (PR:L - i.e. an actor able to submit requests to the inference endpoint), with no confidentiality or integrity impact and high availability impact. All three described defects (per-request backend mismatch re-raising a grammar compilation exception, ngram_gpu speculative padding passing a negative token to guidance validation, and the Rust frontend admitting empty structured-output values) converge on the same outcome: an ordinary constrained-generation request escapes request-scoped validation, reaches the EngineCore fatal-error path, and terminates the SHARED engine - so one malicious or malformed request can take down service for all tenants. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so this is 'no public exploit identified at time of analysis.' The GitHub source evidence is the fix commit and regression tests, not weaponized exploit code. Note one metadata conflict: the input Tag 'Information Disclosure' contradicts the CVSS vector (C:N), which shows no confidentiality impact - this is a denial-of-service issue, so treat the 'Information Disclosure' tag as erroneous. Overall: a real reliability/availability risk for multi-tenant vLLM deployments, but the low-to-no exploitation signals and availability-only impact keep it below critical priority. |
| Exploit ScenarioDerived | An actor with access to a multi-tenant vLLM inference endpoint submits a constrained-generation (structured-output) request crafted to trigger one of the three validation-escape paths - for example a backend mismatch that re-raises a grammar compilation exception, or (on a speculative-decoding deployment using ngram_gpu) input that causes a negative token to reach guidance validation. The failure escapes request-scoped handling and hits the EngineCore fatal-error path, crashing the shared engine and denying service to all other users of that instance. No public exploit code is identified; fix tests exist but are defensive regression tests, not an attack POC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Structured-output validation in vLLM versions prior to 0.30.0 can escape the per-request path and terminate the shared EngineCore process, denying service to every co-tenant on that engine. Three distinct triggers are sufficient on their own: a per-request structured-output backend mismatch that re-raises a grammar compilation exception, the -1 sentinel padding generated by the ngram_gpu speculative-decoding mode being passed as a negative token id to llguidance validation, and a Rust frontend that admits empty structured-output values which the Python frontend correctly rejects. Exploitation requires the ability to submit constrained-generation requests to the inference endpoint (CVSS PR:L, unauthenticated only if the endpoint is exposed without authentication), and the impact is availability-only with no code execution or data exposure; no public exploit code was identified at time of analysis and the flaw is fixed in 0.30.0.
RemediationAI
Upgrade to vLLM 0.30.0, the vendor-released fixed version, which contains commit c55e15a44ec4127832d4a86928a356fdd9e68dbd and addresses all three trigger paths; the vendor advisory is at https://github.com/vllm-project/vllm/security/advisories/GHSA-85xf-c7hm-whqw and the release notes at https://github.com/vllm-project/vllm/releases/tag/v0.30.0. If an immediate upgrade is not possible, apply targeted compensating controls: disable structured output / guided decoding so that no grammar is compiled or validated (this removes the attack surface entirely but also removes constrained-generation guarantees for legitimate callers); avoid speculative decoding with the ngram_gpu mode, or disable speculative decoding altogether, so the -1 sentinel padding path cannot be reached (at the cost of reduced throughput); and force the Python request frontend instead of the Rust frontend so that empty structured-output values are rejected before reaching the engine (at the cost of the Rust frontend's performance characteristics). Because exploitation requires request-submission access (PR:L), requiring authentication on the inference endpoint, rate-limiting structured-output requests per principal, and isolating untrusted tenants onto separate vLLM instances each reduce the blast radius of the shared EngineCore design - none of these fully mitigate a party already authorized to submit requests. No vendor-released patch alternative exists beyond version 0.30.0; the upgrade is the only complete fix.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vLLM is a high-throughput inference and serving engine for large language models, built around an EngineCore that processes requests for many tenants through a shared scheduler and model runner. Structured (guided) output is enforced by pluggable backends such as llguidance/guidance, which receive draft or sampled token ids and validate them against a compiled grammar; the guidance matcher raises OverflowError when it encounters a negative token id. The root-cause class is CWE-20 (improper input validation): validation that should be scoped to a single request is instead allowed to propagate an exception into the EngineCore fatal-error path. The commit and accompanying tests show the two concrete mechanisms, namely that ngram_gpu speculative decoding pads unfilled draft slots with -1, and that GuidanceGrammar.validate_tokens must stop at the first sentinel rather than forwarding it, while update_draft_token_ids and update_draft_token_ids_in_output must strip that padding before grammar validation (the -1 pad-back in scheduled_spec_decode_tokens being preserved intentionally). The third mechanism is an inconsistency between the Rust and Python request frontends for empty structured-output values. A per-request backend mismatch can also re-raise a grammar compilation exception. Because EngineCore is shared, any of these failures escalates from a single malformed request into an engine-wide denial of service. Note that the supplied tag labels this record as 'Information Disclosure', which does not match the assessed impact - the authoritative assessment is availability-only (C:N/I:N/A:H on CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U).
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable constrained-generation request from an actor able to submit requests (PR:L), low complexity, crashing the shared engine yields A:H with no C/I impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
DescriptionCVE.org
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust frontend can admit empty structured-output values that the Python frontend rejects, allowing ordinary constrained-generation requests to terminate the shared engine. This issue is fixed in version 0.30.0.
Blast Radius
ecosystem impact- 4 pypi packages depend on vllm (4 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.30.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)CVE.org
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB