CVE-2026-100651

[CVE catalog]

Severity

High · CVSS 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Sep 13, 2026, 10:00:00 PM UTC

Updated

Sep 26, 2026, 2:16:47 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.38% · Oct 25, 2026

A flaw was found in vLLM. The service fails to properly enforce length limits on input prompts when handling certain multimodal inference requests. A remote attacker with access to the inference service could exploit this vulnerability by submitting an excessively long prompt, causing an internal worker crash and leading to a Denial of Service (DoS). vllm: vLLM: Denial of Service via overlong multimodal inference requests The GHSA affected package line says < 0.29.0. But the advisory’s own source later points out the affecting version range to start from >= 0.20.0 and explicitly marks older tags such as v0.12.0–v0.17.0 as not affected. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.