Dashboard / CVE-2026-71486

CVE-2026-71486

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 59/100
Published: 2026-08-17 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: None
I: None
A: Low

Description

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generate_responses, choices, token_ids, prompt_logprobs, logprobs.content, top_logprobs, and routed_experts structures are processed by OnlineDerenderer and tokenizer.decode before max_model_len, max_tokens, max_num_seqs, or response-size limits are enforced, allowing an authenticated API client to consume excessive CPU and memory and produce oversized responses. This issue is fixed in version 0.26.0.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
vllm vllm < 0.26.0

References & Advisories (4)

Bug Bounty Relevance

59 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

4.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS — Exploitation Probability

0.37%
Raw Score 0.003740
Percentile 31.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00374
2026-10-28
0.00374

Intelligence Sources

nvd ref →

External Links