CVE-2026-73559

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73559
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73559.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73559
Aliases
Downstream
Published
2026-08-13T15:09:02.493Z
Modified
2026-08-16T03:31:27.838884602Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
vLLM: Completion prompt lists fan out into unbounded engine requests
Details

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded list[str] or list[list[int]], prompttoseq() in vllm/renderers/inputs/preprocess.py and OnlineRenderer.preprocesscompletion() in vllm/renderers/onlinerenderer.py expand every element, and vllm/entrypoints/openai/completion/serving.py creates one engine generator and response slot per prompt, allowing an authenticated API client to exhaust CPU, memory, async scheduling capacity, engine request slots, and response buffering with one request. This issue is fixed in version 0.26.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73559.json"
}
References

Affected packages

Git / github.com/vllm-project/vllm

Affected ranges

Type
GIT
Repo
https://github.com/vllm-project/vllm
Events
Introduced
2a69949bdadf0e8942b7a1619b229cb475beef20
Fixed
675f4295cdfe0d870471c2b51bfeca3a68a9569e
Fixed
ffd46bfab2128bb84146050e98b51a617c6575ab
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.19.0"
        },
        {
            "fixed": "0.26.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73559.json"