CVE-2026-71486: vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1

vLLM (a system for running and serving large language models) had a vulnerability in versions before 0.26.0 where certain API endpoints accepted user-supplied data that was processed before safety checks could limit resource usage. An authenticated attacker (someone with API access) could exploit this to consume excessive CPU and memory or generate oversized responses that bypass size restrictions.