CVE-2026-73559

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published

Aug 13, 2026, 3:09:02 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.58% · Oct 27, 2026

A flaw was found in vLLM, an inference and serving engine for large language models. An authenticated API client can exploit this vulnerability by sending a single request to the /v1/completions endpoint with an excessively large list of prompts. This unbounded input causes the vLLM server to allocate a disproportionate amount of CPU, memory, and other resources, leading to a Denial of Service (DoS) condition. This can disrupt or starve other services sharing the same vLLM instance. vllm: vLLM: Denial of Service via unbounded completion prompt lists Moderate: An authenticated API client in Red Hat OpenShift AI could exploit a flaw in the vLLM component by submitting an excessively large list of prompts. This could lead to resource exhaustion, causing a denial of service for the inference engine. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.