EUVD-2026-60376
GHSA-8737-qx52-hjff
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Network-reachable API requires authenticated access (PR:L); only availability degradation applies with no confidentiality or integrity impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3Blast Radius
ecosystem impact- 3 pypi packages depend on vllm (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.26.0.
DescriptionCVE.org
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generate_responses, choices, token_ids, prompt_logprobs, logprobs.content, top_logprobs, and routed_experts structures are processed by OnlineDerenderer and tokenizer.decode before max_model_len, max_tokens, max_num_seqs, or response-size limits are enforced, allowing an authenticated API client to consume excessive CPU and memory and produce oversized responses. This issue is fixed in version 0.26.0.
AnalysisAI
Uncontrolled resource consumption in vLLM's derender API endpoints allows authenticated clients to exhaust server CPU and memory by submitting arbitrarily large caller-supplied GenerateResponse objects. All vLLM versions prior to 0.26.0 process structures including generate_responses, choices, token_ids, prompt_logprobs, logprobs.content, top_logprobs, and routed_experts through OnlineDerenderer and tokenizer.decode before enforcing any model or response-size limits. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privilege API credential to the vLLM server (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) accurately reflects a low-complexity, network-reachable DoS constrained by a PR:L authentication requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade vLLM to version 0.26.0 or later, which enforces pre-processing validation bounds on token_ids (against max_model_len), choices count (against VLLM_MAX_N_SEQUENCES), generate_responses count, logprobs.content length, top_logprobs count, and rejects negative token_ids with HTTP 400 responses before any resource-intensive processing occurs. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today