CVE-2026-73559: vLLM: Completion prompt lists fan out into unbounded engine requests
The /v1/completions request model accepts prompt as a list of text prompts or a list of token-id prompts without any outer prompt-count bound. The serving path turns each element into a separate engine input, creates one engine generator per element, merges all generators, and allocates a response slot per prompt. An authenticated API client can therefore turn one request into an attacker-chosen number of backend subrequests before any aggregate request-count budget is enforced.
References
- github.com/advisories/GHSA-87x5-vmc3-756j
- github.com/vllm-project/vllm/commit/675f4295cdfe0d870471c2b51bfeca3a68a9569e
- github.com/vllm-project/vllm/pull/47845
- github.com/vllm-project/vllm/releases/tag/v0.26.0
- github.com/vllm-project/vllm/security/advisories/GHSA-87x5-vmc3-756j
- nvd.nist.gov/vuln/detail/CVE-2026-73559
Code Behaviors & Features
Detect and mitigate CVE-2026-73559 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →