Resource Exhaustion Vulnerability in vLLM Engine Affecting Large Language Models by vLLM Project

CVE-2026-71486

What is CVE-2026-71486?

The vLLM engine, which is utilized for inference and serving large language models, contains a vulnerability affecting versions prior to 0.26.0. This vulnerability is associated with endpoints /v1/completions/derender and /v1/chat/completions/derender that improperly handle caller-supplied GenerateResponse objects. The lack of enforcement for maximum limits on token count, model length, and response size permits authenticated API clients to exhaust server CPU and memory resources. This leads to potential performance degradation, preventing legitimate users from accessing the service effectively. The issue has been addressed in version 0.26.0, which includes updated validations to mitigate this risk.

References