vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generate_responses, choices, token_ids, prompt_logprobs, logprobs.content, top_logprobs, and routed_experts structures are processed by OnlineDerenderer and tokenizer.decode before max_model_len, max_tokens, max_num_seqs, or response-size limits are enforced, allowing an authenticated API client to consume excessive CPU and memory and produce oversized responses. This issue is fixed in version 0.26.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/vllm-project/vllm/commit/8e61b646e2d157f9b93451fa048f9c8530c8a67b Patch
- https://github.com/vllm-project/vllm/pull/47260 Issue Tracking, Patch
- https://github.com/vllm-project/vllm/security/advisories/GHSA-8737-qx52-hjff Exploit, Vendor Advisory, Mitigation
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.3 · vllmNVD modified 2026-10-23 16:10
Affected (CPE criteria) 1
cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*
References 4
- https://github.com/vllm-project/vllm/commit/8e61b646e2d157f9b93451fa048f9c8530c8a67b Patch
- https://github.com/vllm-project/vllm/pull/47260 Issue Tracking, Patch
- https://github.com/vllm-project/vllm/releases/tag/v0.26.0 Release Notes
- https://github.com/vllm-project/vllm/security/advisories/GHSA-8737-qx52-hjff Exploit, Vendor Advisory, Mitigation