Memory Exhaustion Vulnerability in vLLM by VLLM Project

CVE-2026-93436

What is CVE-2026-93436?

A memory exhaustion vulnerability in vLLM prior to version 0.29.0 allows remote attackers to leverage improperly handled decode-side metadata during rejected inference requests. Exploiting this flaw, attackers can submit requests with parameters like max_tokens=0, leading to unbounded memory consumption on decode workers. As a result, this can cause a denial of service when the worker exhausts its memory and restarts, impacting the availability of the service. Organizations using vLLM should apply the latest patches to mitigate this issue.

References