CVE-2026-105757: vLLM unhandled structured-output

Q: Is CVE-2026-105757 actively exploited?

No confirmed active exploitation of CVE-2026-105757 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-105757?

1) Upgrade vllm (pip) to 0.30.0 or later (fix in PR #51450, commit c55e15a). 2) Until patched: disable or restrict structured-output/guided-decoding features for untrusted callers, reject empty or malformed structured-output values at an API gateway, avoid ngram_gpu speculative decoding with guidance backends, and avoid the Rust frontend where possible. 3) Place vLLM behind authentication and per-client rate limits, and run it under a supervisor (Kubernetes liveness/restart policy, systemd) with multiple replicas so one crash does not cause a full outage. 4) Detection: alert on EngineCore fatal-error and unexpected process exits in logs, repeated restarts, and a spike in 5xx/connection-reset errors correlated with requests carrying structured-output parameters. 5) Track GHSA-85xf-c7hm-whqw for updates.

Q: What systems are affected by CVE-2026-105757?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference gateways, multi-tenant inference platforms, RAG pipelines, agent frameworks, structured-output / constrained generation workloads.

Q: What is the CVSS score for CVE-2026-105757?

CVE-2026-105757 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.31%.

CISO Take

CVE-2026-105757 is a denial-of-service flaw in vLLM before 0.30.0 where ordinary structured-output (constrained generation) requests can trigger exceptions that escape per-request validation and kill the shared EngineCore, taking down inference for every tenant at once. Any authenticated low-privilege API user can trigger it over the network with low complexity, and the shared-engine design means one bad request has an outsized blast radius. Mitigating factors: the impact is availability only (no confidentiality or integrity loss), the CVSS is 6.5 medium, the EPSS is low (0.00312, though the 78th percentile still puts it above most CVEs), and it is not in CISA KEV, with no public exploit or Nuclei template. However, vLLM has 124 other tracked CVEs and 95 downstream dependents, so any production inference stack built on it is exposed. Upgrade to vLLM 0.30.0 or later, and until then restrict or validate structured-output parameters at the gateway and put the engine behind a supervisor that restarts it automatically.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

Medium overall. Exploitability is easy (network, low complexity, low privileges, no user interaction) but requires an authenticated or otherwise permitted API caller who can send structured-output requests. Impact is limited to availability (A:H), yet it is a single point of failure: one request can terminate the shared engine and drop all concurrent inferences. Exploitation likelihood is low-to-moderate (EPSS 0.31%, 78th percentile), with no known public exploit and no KEV listing. The risk rises for multi-tenant or internet-exposed LLM gateways where untrusted users can set guided decoding or JSON schema parameters.

How does the attack unfold?

Initial Access

Attacker uses a low-privilege API key or reachable endpoint to call the vLLM inference API.

AML.T0040

Exploitation

A crafted structured-output request (empty value, backend mismatch, or negative padding token) raises an exception that escapes request-scoped validation.

AML.T0049

Impact

The exception reaches the EngineCore fatal-error path and terminates the shared engine, dropping all tenants' requests.

AML.T0029

Initial Access

Attacker uses a low-privilege API key or reachable endpoint to call the vLLM inference API.

AML.T0040

Exploitation

A crafted structured-output request (empty value, backend mismatch, or negative padding token) raises an exception that escapes request-scoped validation.

AML.T0049

Impact

The exception reaches the EngineCore fatal-error path and terminates the shared engine, dropping all tenants' requests.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	< 0.30.0	`0.30.0`
95.4K94 dependentsPushed 6d ago27% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade vllm (pip) to 0.30.0 or later (fix in PR #51450, commit c55e15a). 2) Until patched: disable or restrict structured-output/guided-decoding features for untrusted callers, reject empty or malformed structured-output values at an API gateway, avoid ngram_gpu speculative decoding with guidance backends, and avoid the Rust frontend where possible. 3) Place vLLM behind authentication and per-client rate limits, and run it under a supervisor (Kubernetes liveness/restart policy, systemd) with multiple replicas so one crash does not cause a full outage. 4) Detection: alert on EngineCore fatal-error and unexpected process exits in logs, repeated restarts, and a spike in 5xx/connection-reset errors correlated with requests carrying structured-output parameters. 5) Track GHSA-85xf-c7hm-whqw for updates.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSInferenceFrameworkAPIAML.T0029- Denial of AI Service AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.4-Mechanisms to supersede, disengage, or deactivate AI systems

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-105757?

CVE-2026-105757 is a denial-of-service flaw in vLLM before 0.30.0 where ordinary structured-output (constrained generation) requests can trigger exceptions that escape per-request validation and kill the shared EngineCore, taking down inference for every tenant at once. Any authenticated low-privilege API user can trigger it over the network with low complexity, and the shared-engine design means one bad request has an outsized blast radius. Mitigating factors: the impact is availability only (no confidentiality or integrity loss), the CVSS is 6.5 medium, the EPSS is low (0.00312, though the 78th percentile still puts it above most CVEs), and it is not in CISA KEV, with no public exploit or Nuclei template. However, vLLM has 124 other tracked CVEs and 95 downstream dependents, so any production inference stack built on it is exposed. Upgrade to vLLM 0.30.0 or later, and until then restrict or validate structured-output parameters at the gateway and put the engine behind a supervisor that restarts it automatically.

Is CVE-2026-105757 actively exploited?

No confirmed active exploitation of CVE-2026-105757 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-105757?

1) Upgrade vllm (pip) to 0.30.0 or later (fix in PR #51450, commit c55e15a). 2) Until patched: disable or restrict structured-output/guided-decoding features for untrusted callers, reject empty or malformed structured-output values at an API gateway, avoid ngram_gpu speculative decoding with guidance backends, and avoid the Rust frontend where possible. 3) Place vLLM behind authentication and per-client rate limits, and run it under a supervisor (Kubernetes liveness/restart policy, systemd) with multiple replicas so one crash does not cause a full outage. 4) Detection: alert on EngineCore fatal-error and unexpected process exits in logs, repeated restarts, and a spike in 5xx/connection-reset errors correlated with requests carrying structured-output parameters. 5) Track GHSA-85xf-c7hm-whqw for updates.

What systems are affected by CVE-2026-105757?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference gateways, multi-tenant inference platforms, RAG pipelines, agent frameworks, structured-output / constrained generation workloads.

What is the CVSS score for CVE-2026-105757?

CVE-2026-105757 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.31%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inference gatewaysmulti-tenant inference platformsRAG pipelinesagent frameworksstructured-output / constrained generation workloads

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust frontend can admit empty structured-output values that the Python frontend rejects, allowing ordinary constrained-generation requests to terminate the shared engine. This issue is fixed in version 0.30.0.

Exploitation Scenario

An attacker with a low-privilege API key (or access to an exposed, weakly authenticated vLLM endpoint) sends a chat-completion request with a crafted structured-output parameter, for example an empty value via the Rust frontend, or a request whose backend choice differs from the engine default so grammar compilation fails and the exception is re-raised. The exception bypasses request-scoped validation and reaches the EngineCore fatal-error path, terminating the shared engine. The attacker repeats the request each time the service restarts, keeping the inference service down for all tenants and disrupting dependent RAG, agent and customer-facing applications.

Weaknesses (CWE)

CWE-20Improper Input ValidationPrimary CWE-20Improper Input ValidationPrimary CWE-248Uncaught ExceptionPrimary CWE-248Uncaught ExceptionPrimary CWE-755Improper Handling of Exceptional ConditionsPrimary CWE-755Improper Handling of Exceptional ConditionsPrimary CWE-20Improper Input Validation CWE-248Uncaught Exception CWE-755Improper Handling of Exceptional Conditions

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.