CVE-2026-73559
published 2026-08-13CVE-2026-73559: vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.39%
32.0th percentile
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded list[str] or list[list[int]], prompt_to_seq() in vllm/renderers/inputs/preprocess.py and OnlineRenderer.preprocess_completion() in vllm/renderers/online_renderer.py expand every element, and vllm/entrypoints/openai/completion/serving.py creates one engine generator and response slot per prompt, allowing an authenticated API client to exhaust CPU, memory, async scheduling capacity, engine request slots, and response buffering with one request. This issue is fixed in version 0.26.0.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
| rhaii | vllm-neuron-rhel9 | — | — |
| rhaii | vllm-rocm-rhel9 | — | — |
| rhaii | vllm-spyre-rhel9 | — | — |
| rhaii | vllm-tpu-rhel9 | — | — |
| rhaiis | vllm-cpu-rhel9 | — | — |
| rhaiis | vllm-cuda-rhel9 | — | — |
| rhaiis | vllm-neuron-rhel9 | — | — |
| rhaiis | vllm-rocm-rhel9 | — | — |
| rhaiis | vllm-spyre-rhel9 | — | — |
| rhaiis | vllm-tpu-rhel9 | — | — |
| rhelai3 | bootc-aws-cuda-rhel9 | — | — |
| rhelai3 | bootc-azure-cuda-rhel9 | — | — |
| rhelai3 | bootc-azure-rocm-rhel9 | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-gcp-cuda-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhoai | odh-kserve-agent-rhel9 | — | — |
| rhoai | odh-kserve-controller-rhel9 | — | — |
| rhoai | odh-kserve-router-rhel9 | — | — |
| rhoai | odh-kserve-storage-initializer-rhel9 | — | — |
| rhoai | odh-llm-d-kv-cache-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
vllm: vLLM: Denial of Service via unbounded completion prompt lists
vendor_redhat·2026-08-13·CVSS 6.5
CVE-2026-73559 [MEDIUM] CWE-770 vllm: vLLM: Denial of Service via unbounded completion prompt lists
vllm: vLLM: Denial of Service via unbounded completion prompt lists
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded list[str] or list[list[int]], prompt_to_seq() in vllm/renderers/inputs/preprocess.py and OnlineRenderer.preprocess_completion() in vllm/renderers/online_renderer.py expand every element, and vllm/entrypoints/openai/completion/serving.py creates one engine generator and response slot per prompt, allowing an authenticated API client to exhaust CPU, memory, async scheduling capacity, engine request slots, and response buffering with one request. This issue is fixed in version 0.26.0.
A flaw was found in vLLM, an
VulDB
vllm-project vLLM up to 0.25.x Completion Request online_renderer.py OnlineRenderer.preprocess_completion prompt resource consumption (WID-SEC-2026-2842)
vuldb·2026-08-16·CVSS 6.5
CVE-2026-73559 [MEDIUM] vllm-project vLLM up to 0.25.x Completion Request online_renderer.py OnlineRenderer.preprocess_completion prompt resource consumption (WID-SEC-2026-2842)
A vulnerability was found in vllm-project vLLM up to 0.25.x. It has been rated as problematic. Affected by this issue is the function OnlineRenderer.preprocess_completion of the file vllm/renderers/online_renderer.py of the component Completion Request. This manipulation of the argument prompt causes resource consumption.
The identification of this vulnerability is CVE-2026-73559. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is advised.
GHSA
vLLM: Completion prompt lists fan out into unbounded engine requests
ghsa·2026-08-13
CVE-2026-73559 [MEDIUM] CWE-400 vLLM: Completion prompt lists fan out into unbounded engine requests
vLLM: Completion prompt lists fan out into unbounded engine requests
## Summary
The `/v1/completions` request model accepts `prompt` as a list of text prompts or a list of token-id prompts without any outer prompt-count bound. The serving path turns each element into a separate engine input, creates one engine generator per element, merges all generators, and allocates a response slot per prompt. An authenticated API client can therefore turn one request into an attacker-chosen number of backend subrequests before any aggregate request-count budget is enforced.
## Technical Details
`CompletionRequest.prompt` allows both list-shaped prompt inputs and scalar prompts:
```python
# vllm/entrypoints/openai/completion/protocol.py
prompt: (
list[Annotated[int, Field(ge=0)]]
| list[list[Annota
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/vllm-project/vllm/commit/675f4295cdfe0d870471c2b51bfeca3a68a9569ehttps://github.com/vllm-project/vllm/pull/47845https://github.com/vllm-project/vllm/releases/tag/v0.26.0https://github.com/vllm-project/vllm/security/advisories/GHSA-87x5-vmc3-756jhttps://github.com/vllm-project/vllm/security/advisories/GHSA-87x5-vmc3-756j
2026-08-13
Published