Denial of Service in vLLM Large Language Model Inference Engine

CVE-2026-69147

What is CVE-2026-69147?

vLLM, an inference and serving engine for large language models, has a vulnerability that could be exploited to exhaust GPU memory resources. When configured with specific video processing backends, an attacker can send specially crafted requests that lead the engine to allocate resources without proper management. This results in a situation where the system's available GPU memory is depleted, potentially causing request failures, crashes, or denial of service. The issue scores particularly high given the widespread use of GPU-based deployments. Version 0.28.0 addresses this vulnerability, ensuring that memory allocations are appropriately managed and that resource exhaustion is prevented.

References