7.5High
CVE-2026-114051vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate
Description
vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.
Weakness (CWE):
CWE-248
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| vllm-project | vllm | < 0.31.0, fixed 0.31.0 |
References and patches
- GitHub Security Advisory (GHSA-4xqp-c3mv-qff7) vendor-advisory
- VulnCheck Advisory: vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate third-party-advisory