{"data":{"id":"e2bd92eb-372a-468e-ad65-1e8741ec486d","title":"CVE-2026-73559: vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions Complet","summary":"vLLM (an AI model serving system) versions 0.19.0 to 0.26.0 have a vulnerability where the /v1/completions endpoint accepts unlimited lists of prompts, causing the system to create excessive processing tasks. An authenticated attacker could send a single request with many prompts to overwhelm the server's CPU, memory, and scheduling capacity, making it unavailable to other users.","solution":"This issue is fixed in version 0.26.0. Users should update vLLM to version 0.26.0 or later.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73559","publishedAt":"2026-08-13T16:19:05.863Z","cveId":"CVE-2026-73559","cweIds":["CWE-400"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-08-13T16:19:05.863Z","capecIds":["CAPEC-125","CAPEC-130"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}