CVE-2026-114051: vLLM validation bypass in /inference/v1/generate requests with null max_tokens

Summary

vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests when max_tokens is null. The EngineCore input thread then dies on an uncaught VLLMValidationError, while /health still returns 200. An unauthenticated remote attacker can send one request with an oversized min_tokens to hang all later generation requests until a manual restart.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Inference infrastructure

Related items

• HighCVE-2026-114055: vLLM uncontrolled resource consumption via per-request mm_processor_kwargsSimilar attack · NVD/CVE Database
• HighCVE-2026-114052: vLLM memory exhaustion in MOSS-Audio model serving via /tokenize endpointSimilar attack · NVD/CVE Database
• HighCVE-2026-114050: vLLM denial of service via client-supplied multimodal uuid cache desyncSimilar attack · NVD/CVE Database
• HighGHSA-46jr-4wx8-v453: MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationSimilar attack · GitHub Advisory Database
• LowLLM Trojans that Increase Response Lengths and CostSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)