CVE-2026-114051

High

Description

vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.

SeverityHigh

CVSS7.5

Exploit probability—

ProductVllm

PublishedOct 21, 2026

First seenOct 21, 2026

Weakness typeCWE-248CWE-248

How to fix

Update

vllm vllm0.31.0 or later

Vendor advisories

github.com/vllm-project/vllm/security/advisories/GHSA-4xqp-c3mv-qff7

Affected products

Product	Affected versions	Fixed in
vllm vllm	v < 0.31.0	0.31.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.