SB2026100644 - Multiple vulnerabilities in vLLM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026100644

SB2026100644 - Multiple vulnerabilities in vLLM

Published: October 6, 2026 Updated: November 13, 2026

Security Bulletin ID SB2026100644
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 44% Low 56%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-105758)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the Qwen2VLVideoBackend and Qwen3VLVideoBackend video samplers when processing video requests with request-controlled max_frames and fps values. A remote attacker can submit a crafted video request that sets excessive max_frames and fps values to cause a denial of service.

The Rust frontend is not affected.


2) Resource exhaustion (CVE-ID: CVE-2026-105759)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the vLLM Rust frontend track_http_metrics middleware when processing HTTP requests with arbitrary method tokens. A remote attacker can send requests using unique arbitrary HTTP method tokens to cause a denial of service.

Only deployments with the Rust frontend enabled are vulnerable.


3) Resource exhaustion (CVE-ID: CVE-2026-105760)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a partial denial of service.

The vulnerability exists due to uncontrolled resource consumption in the GLMGA video sampler when processing request-controlled video sampling options. A remote attacker can submit a crafted chat-completion request with a small video and excessive fps and max_frames values to cause a partial denial of service.

Exploitation requires chat completions for a video-capable model to accept request-level media_io_kwargs.


4) Uncaught Exception (CVE-ID: CVE-2026-105757)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper handling of exceptional conditions in the StructuredOutputManager when compiling a duplicate-root EBNF grammar through a latched structured-output backend. A remote user can send structured-output requests that cause an unhandled grammar compilation exception to terminate the shared EngineCore and cause a denial of service.

Exploitation requires two structured-output requests and affects the default automatic backend selection.


5) Reachable assertion (CVE-ID: CVE-2026-126398)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to terminate the vLLM engine and API server, disconnecting all concurrent clients.

The vulnerability exists due to a reachable assertion in the V1 GPU model runner when an XD-RoPE model receives embeddings without token IDs. An unauthenticated remote attacker can send one embeddings-only request to /v1/completions when --enable-prompt-embeds is enabled and API authentication is disabled, causing service-wide denial of service.


6) Input validation error (CVE-ID: CVE-2026-105754)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated remote attacker to crash vLLM's shared EngineCore process, denying model service to all tenants.

The vulnerability exists due to insufficient validation of caller-supplied multimodal features against the active model's renderer contract in the scale-out generate endpoint. An authenticated remote attacker can submit a single request containing forged multimodal metadata to /inference/v1/generate, triggering a fatal engine error in a scale-out multimodal deployment.


7) Input validation error (CVE-ID: CVE-2026-105756)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to cause a denial of service for all concurrent users of a vLLM server.

The vulnerability exists due to insufficient validation of cache_salt in vLLM request models when the optional LMCache-MP KV connector is enabled. A low-privileged remote attacker can submit a single request containing a salt rejected by LMCache, triggering an uncaught validation exception that terminates the EngineCore process.


8) Use of cache containing sensitive information (CVE-ID: CVE-2026-105752)

CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated remote tenant to determine whether another tenant processed a guessed post-tool history in a shared vLLM deployment.

The vulnerability exists due to dropped cache_salt values during salted GPT-OSS Harmony tool continuations at /v1/responses, exposing continuation prefixes to the shared cache when prefix caching and operator-enabled tools are active. An authenticated remote tenant can submit a reconstructed history without a salt and inspect exact cached-token counts to identify matching victim activity.


9) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-105755)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to corrupt another user's scoring or reranking results and induce transient request errors.

The vulnerability exists due to vLLM's use of caller-controlled X-Request-Id values as query embedding cache keys for /score and /rerank when flash late interaction is enabled. A low-privileged remote attacker can reuse a known victim request identifier in a concurrent request to overwrite cached embeddings, causing the victim's documents to be scored against the attacker's query.


Remediation

Install update from vendor's website.

References