CVE-2026-71486: vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
The /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects and postprocess every nested choices[*].token_ids list directly. Unlike the normal render/generate path, derender does not enforce model context length, resolved max_tokens, max_num_seqs, choice-count, or response-size bounds before detokenizing and returning the supplied token IDs. An authenticated API client can therefore make the CPU-only render frontend, or any server exposing these /v1 derender routes, spend CPU and memory proportional to attacker-chosen generated-output-shaped JSON rather than to a bounded generation result.
References
- github.com/advisories/GHSA-8737-qx52-hjff
- github.com/vllm-project/vllm/commit/8e61b646e2d157f9b93451fa048f9c8530c8a67b
- github.com/vllm-project/vllm/pull/47260
- github.com/vllm-project/vllm/releases/tag/v0.26.0
- github.com/vllm-project/vllm/security/advisories/GHSA-8737-qx52-hjff
- nvd.nist.gov/vuln/detail/CVE-2026-71486
Code Behaviors & Features
Detect and mitigate CVE-2026-71486 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →