{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-34756", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T19:17:10.225Z", "datePublished": "2026-04-06T15:40:03.448Z", "dateUpdated": "2026-08-25T12:05:38.979Z" }, "containers": { "cna": { "title": "vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server", "problemTypes": [ { "descriptions": [ { "cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } } ], "references": [ { "name": "https://github.com/vllm-project/vllm/security/advisories/GHSA-3mwp-wvh9-7528", "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-3mwp-wvh9-7528" }, { "name": "https://github.com/vllm-project/vllm/pull/37952", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/vllm-project/vllm/pull/37952" }, { "name": "https://github.com/vllm-project/vllm/commit/b111f8a61f100fdca08706f41f29ef3548de7380", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/vllm-project/vllm/commit/b111f8a61f100fdca08706f41f29ef3548de7380" } ], "affected": [ { "vendor": "vllm-project", "product": "vllm", "versions": [ { "version": ">= 0.1.0, < 0.19.0", "status": "affected" } ] } ], "providerMetadata": { "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T15:40:03.448Z" }, "descriptions": [ { "lang": "en", "value": "vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM OpenAI-compatible API server. Due to the lack of an upper bound validation on the n parameter in the ChatCompletionRequest and CompletionRequest Pydantic models, an unauthenticated attacker can send a single HTTP request with an astronomically large n value. This completely blocks the Python asyncio event loop and causes immediate Out-Of-Memory crashes by allocating millions of request object copies in the heap before the request even reaches the scheduling queue. This vulnerability is fixed in 0.19.0." } ], "source": { "advisory": "GHSA-3mwp-wvh9-7528", "discovery": "UNKNOWN" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-04-07T14:16:25.517505Z", "id": "CVE-2026-34756", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T14:17:12.597Z" } }, { "affected": [ { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3.2::el9" ], "defaultStatus": "affected", "packageName": "rhaiis/vllm-cuda-rhel9", "product": "Red Hat AI Inference Server 3.2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782951012", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3.2::el9" ], "defaultStatus": "affected", "packageName": "rhaiis/vllm-rocm-rhel9", "product": "Red Hat AI Inference Server 3.2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782951244", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhaii/vllm-cpu-rhel9", "product": "Red Hat AI Inference Server 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787151769", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhaii/vllm-spyre-rhel9", "product": "Red Hat AI Inference Server 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787151840", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhaii/vllm-cuda-rhel9", "product": "Red Hat AI Inference Server 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787151771", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhaii/vllm-rocm-rhel9", "product": "Red Hat AI Inference Server 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787151774", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhelai3/disk-image-cuda-rhel9", "product": "Red Hat Enterprise Linux AI 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787310717", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhelai3/bootc-aws-cuda-rhel9", "product": "Red Hat Enterprise Linux AI 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787253912", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhelai3/bootc-azure-cuda-rhel9", "product": "Red Hat Enterprise Linux AI 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787253989", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhelai3/bootc-azure-rocm-rhel9", "product": "Red Hat Enterprise Linux AI 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787254059", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhelai3/bootc-cuda-rhel9", "product": "Red Hat Enterprise Linux AI 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787243961", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhelai3/bootc-gcp-cuda-rhel9", "product": "Red Hat Enterprise Linux AI 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787253774", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3.4::el9" ], "defaultStatus": "affected", "packageName": "rhelai3/bootc-rocm-rhel9", "product": "Red Hat Enterprise Linux AI 3.4", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787244006", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3" ], "defaultStatus": "affected", "packageName": "rhaiis/vllm-neuron-rhel9", "product": "Red Hat AI Inference Server", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:ai_inference_server:3" ], "defaultStatus": "affected", "packageName": "rhaiis/vllm-tpu-rhel9", "product": "Red Hat AI Inference Server", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-agent-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-controller-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-router-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-storage-initializer-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-vllm-cpu-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-vllm-cuda-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-vllm-gaudi-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "affected", "packageName": "rhoai/odh-vllm-rocm-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" } ], "datePublic": "2026-04-06T15:40:03.448Z", "descriptions": [ { "lang": "en", "value": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large 'n' parameter to the vLLM OpenAI-compatible API server. This can lead to a Denial of Service (DoS) by consuming excessive memory and blocking the system's event loop, causing the server to crash." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-1284", "description": "Improper Validation of Specified Quantity in Input", "lang": "en", "type": "CWE" } ] } ], "references": [ { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2026-34756" }, { "name": "RHBZ#2455425", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455425" }, { "tags": [ "x_sadp-csaf-vex" ], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34756.json" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:36005" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:36006" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:57380" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:57389" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:57390" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:57387" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:59151" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:59144" } ], "solutions": [ { "lang": "en", "value": "RHSA-2026:36005: Red Hat AI Inference Server 3.2" }, { "lang": "en", "value": "RHSA-2026:36006: Red Hat AI Inference Server 3.2" }, { "lang": "en", "value": "RHSA-2026:57380: Red Hat AI Inference Server 3.4" }, { "lang": "en", "value": "RHSA-2026:57389: Red Hat AI Inference Server 3.4" }, { "lang": "en", "value": "RHSA-2026:57390: Red Hat AI Inference Server 3.4" }, { "lang": "en", "value": "RHSA-2026:57387: Red Hat AI Inference Server 3.4" }, { "lang": "en", "value": "RHSA-2026:59151: Red Hat Enterprise Linux AI 3.4" }, { "lang": "en", "value": "RHSA-2026:59144: Red Hat Enterprise Linux AI 3.4" } ], "timeline": [ { "lang": "en", "time": "2026-04-06T16:03:45.222Z", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2026-04-06T15:40:03.448Z", "value": "Made public." } ], "title": "vllm: vLLM: Denial of Service via excessively large 'n' parameter in OpenAI-compatible API", "workarounds": [ { "lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability." } ], "x_adpType": "supplier", "x_generator": { "engine": "sadp-cli 1.0.0" }, "providerMetadata": { "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-25T12:05:38.979Z" } } ] } }