vLLM
CVE-2026-105759
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vLLM Rust frontend over network
-
DeliverySend requests with unique method tokens to /tokenize
-
ExploitEach token creates permanent Prometheus label set
-
ExecutionMemory and /metrics response grow unbounded
-
ImpactService or monitoring path exhausted (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the vLLM Rust frontend (versions prior to 0.30.0) to be deployed with its track_http_metrics middleware active and at least one 'unguarded' route reachable by the attacker (the advisory names /tokenize; /detokenize is similarly affected per the fix tests). No authentication is needed (PR:N) and no user interaction (UI:N), and default configurations are vulnerable because the middleware records the raw HTTP method token for any request reaching a registered route. Limiting factors: exploitation only applies to the Rust frontend (not necessarily the Python server path), impact is cumulative and requires a sustained stream of many unique method tokens to meaningfully exhaust memory or bloat /metrics, so a single request is harmless and detection via abnormal memory/series growth is feasible. |
| Impact | Signals are consistent and point to a genuine but moderate-priority availability issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reach, and the GitHub-assigned 7.5 derives entirely from availability impact (C:N/I:N/A:H) - there is no confidentiality or integrity exposure, matching CWE-400 (resource exhaustion). EPSS is low at 0.33% (24th percentile), the CVE is NOT in CISA KEV, and SSVC rates Exploitation as 'poc', Automatable 'no', Technical Impact 'partial'. These are mutually reinforcing: a proof-of-concept exists (the fix commit ships a working test that injects unique method tokens like 'XVULNCARD000001' against /tokenize), but there is no evidence of mass automated exploitation. One nuance worth flagging: CVSS encodes A:H (total availability loss), whereas SSVC calls the technical impact only 'partial' and the mechanism is gradual, cumulative memory growth rather than an instant crash - so real-world impact depends on how long an attacker sustains the flood and on monitoring-pipeline fragility. Net: a real defect worth patching, but a slow-burn resource-exhaustion DoS, not a critical RCE. |
| Exploit ScenarioDerived | An attacker with network access to a vLLM instance running the Rust frontend (prior to 0.30.0) scripts an HTTP client to repeatedly hit an unguarded route such as /tokenize, each time supplying a unique arbitrary method token. Each novel token is recorded verbatim as a Prometheus label, permanently allocating new counter and histogram series via Family::get_or_create, so process memory and the /metrics response grow without bound until the service or its monitoring path is exhausted. A proof-of-concept is effectively public: the fix commit includes a regression test that drives this exact behavior with crafted method tokens. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 16, 2026
Unauthenticated requests carrying attacker-chosen HTTP method tokens can drive unbounded Prometheus label growth in vLLM's Rust frontend prior to 0.30.0, exhausting process memory and inflating the /metrics response until the service or its monitoring path becomes unusable (CWE-400, CVSS 7.5 availability-only). The vulnerability applies to deployments where the track_http_metrics middleware is active and an 'unguarded' route such as /tokenize or /detokenize is reachable; the advisory and fix tests confirm those routes accept the request and record the raw method token as a metrics label. Publicly available exploit code exists, but CISA KEV does not list this CVE as actively exploited and EPSS is low (0.33%, ~24th percentile); the CISA SSVC assessment rates technical impact as partial and automation as 'no', since meaningful exhaustion requires a sustained stream of many unique method tokens rather than a single request. The issue is fixed in vLLM 0.30.0.
Earlier versions of this analysis (1)
Unbounded Prometheus label cardinality in the vLLM Rust frontend before 0.30.0 lets unauthenticated remote attackers exhaust process memory and bloat the /metrics endpoint by sending requests carrying unique arbitrary HTTP method tokens. Because the track_http_metrics middleware records the raw method token as a Prometheus label for any request that reaches a registered route, an attacker can repeatedly hit unguarded endpoints such as /tokenize and /detokenize with attacker-controlled method strings, causing Prometheus's Family::get_or_create to permanently retain a new counter and histogram label set for each unique value. The CVSS vector (PR:N) confirms no authentication is required, and impact is limited to availability; no public exploit code or confirmed active exploitation was identified at time of analysis, and effective denial of service requires sustained request volume rather than a single request.
RemediationAI
Upgrade to the fixed release: vendor-released patch in vLLM 0.30.0 (the fix is commit 3735c2d5f5248259482b9045c34fb7a8a3892352, merged via PR 56058 and documented in GHSA-5fj9-pfhr-6j48), which bounds the Prometheus 'method' label by mapping any non-standard HTTP method to the single value 'other' - no configuration change is needed once the patched Rust frontend is deployed, and it does not alter handling of the nine standard methods. If upgrading immediately is not possible, layer compensating controls with explicit trade-offs: reject non-standard HTTP methods at the reverse proxy or ingress in front of the Rust frontend (allow only GET/POST/PUT/PATCH/DELETE/HEAD/OPTIONS/CONNECT/TRACE and return 405 otherwise), which stops new series creation but may break clients or health probes that legitimately use custom methods; restrict network access to the Rust frontend's inference routes (/tokenize, /detokenize and peers) to trusted internal callers via firewall rules or mTLS, accepting that this reduces the service's exposure to intended external consumers; and disable or gate the /metrics endpoint and its scraping so cardinality growth is neither externally observable nor able to bloat the response path, at the cost of losing monitoring visibility. Operationally, set memory limits/restart policies on the frontend container and alert on abnormal growth in process RSS or on the number of distinct 'method' label values returned by /metrics, since a single request is harmless and the impact is cumulative over many unique tokens. All mitigations are secondary to applying the 0.30.0 upgrade, and no vendor-released patch exists for older versions other than upgrading.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vLLM is a high-throughput inference and serving engine for large language models, and recent versions ship a Rust frontend (axum-based) alongside the Python server. The track_http_metrics middleware in rust/src/server/src/middleware/metrics.rs records the HTTP method as a Prometheus label on http_requests_total and http_request_duration_seconds histograms. Before the fix, it used req.method().as_str() directly. HTTP parsers (axum/hyper) accept arbitrary, RFC-allowed method tokens, so an attacker can synthesize unlimited unique method strings and send them from unauthenticated requests to registered routes such as /tokenize and /detokenize. Because Prometheus client libraries key counter/histogram families by a Family::get_or_create label set, each unique token permanently allocates a new time series that is never garbage-collected, producing the classic CWE-400 'uncontrolled resource consumption' / metrics-label-cardinality exhaustion pattern. The upstream commit 3735c2d5f5248259482b9045c34fb7a8a3892352 adds an http_metrics_method() helper that collapses all non-standard methods into a single bounded 'other' label value and includes tests asserting that fabricated tokens like XVULNCARD000001 never appear in rendered metrics; the fix is the bounded-cardinality pattern, not rate limiting or authentication. The affected CPE is cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated low-complexity requests to default routes with only availability impact (memory/series exhaustion), no confidentiality or integrity effect; concurs with the input vector.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus's Family::get_or_create function to permanently create counter and histogram label sets. Those label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted. This issue is fixed in version 0.30.0.
Blast Radius
ecosystem impact- 4 pypi packages depend on vllm (4 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.30.0.
Technical POC Analysis
CWE-400 (Uncontrolled Resource Consumption), realized as unbounded metric label cardinality.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
vLLM's Rust frontend, in versions prior to 0.30.0, is vulnerable to a memory exhaustion issue that can render the service and its monitoring path unavailable. Organizations running affected vLLM deployments-particularly those with the track_http_metrics middleware enabled and public-facing /tokenize or /detokenize endpoints-face potential denial-of-service that could disrupt AI inference workloads and impair observability. Leadership should prioritize remediation because this availability risk can cascade to dependent applications and erode trust in AI service reliability.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB