CVE-2026-114051: vLLM unauth DoS — HIGH

CISO Take

vLLM before 0.31.0 fails to validate that min_tokens does not exceed max_tokens on /inference/v1/generate requests when max_tokens is null, so a single crafted request kills the EngineCore input thread and leaves the server unable to serve any later generation request. The danger is that /health still returns 200, so load balancers and orchestrators will keep routing traffic to a dead node and the outage can go unnoticed until users complain. The attack is unauthenticated, network-reachable and trivial (CVSS 7.5), though there is currently no public exploit, no Nuclei template, no KEV listing and no EPSS score, so exploitation is not yet observed. Upgrade to vLLM 0.31.0 or later, and until then block or restrict access to /inference/v1/generate and add a synthetic generation probe to health monitoring rather than relying on /health.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

High availability risk. The flaw is exploitable over the network with no authentication, no user interaction and low complexity, and a single request is enough to cause a persistent outage requiring manual restart. Confidentiality and integrity are unaffected. Exposure depends on whether the vLLM endpoint is reachable by untrusted parties; internet-facing or shared-tenant inference gateways are at greatest risk. The misleading healthy /health status prolongs outages and defeats automated recovery. No public exploit, scanner template, KEV listing or EPSS data was available at time of analysis, so near-term exploitation likelihood is unquantified, though the trivial trigger makes it easy to weaponize once details circulate.

How does the attack unfold?

Initial Access

Attacker locates a reachable vLLM endpoint exposing /inference/v1/generate without authentication.

AML.T0049

Exploitation

Attacker sends one request with null max_tokens and an oversized min_tokens, bypassing the validation check.

AML.T0040

Engine Failure

The EngineCore input thread dies on an uncaught VLLMValidationError while /health keeps returning 200.

Impact

All subsequent generation requests hang until an operator manually restarts the service.

AML.T0029

Initial Access

Attacker locates a reachable vLLM endpoint exposing /inference/v1/generate without authentication.

AML.T0049

Exploitation

Attacker sends one request with null max_tokens and an oversized min_tokens, bypassing the validation check.

AML.T0040

Engine Failure

The EngineCore input thread dies on an uncaught VLLMValidationError while /health keeps returning 200.

Impact

All subsequent generation requests hang until an operator manually restarts the service.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
95.4K94 dependentsPushed 6d ago27% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade vLLM to 0.31.0 or later. 2) Until patched, do not expose the vLLM server directly to untrusted networks; place it behind an authenticating API gateway and restrict /inference/v1/generate to trusted callers. 3) At the gateway or proxy, validate request bodies and reject requests where max_tokens is null or min_tokens is unreasonably large or exceeds max_tokens. 4) Replace or supplement /health checks with a synthetic end-to-end generation probe with a timeout so hung engines are detected and restarted automatically. 5) Monitor logs for uncaught VLLMValidationError in the EngineCore input thread, stalled request queues and rising request latency, and configure automatic process restart on those signals. 6) Apply rate limiting per client.

How is it classified?

DoSInferenceAPIAML.T0029- Denial of AI Service AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-114051?

vLLM before 0.31.0 fails to validate that min_tokens does not exceed max_tokens on /inference/v1/generate requests when max_tokens is null, so a single crafted request kills the EngineCore input thread and leaves the server unable to serve any later generation request. The danger is that /health still returns 200, so load balancers and orchestrators will keep routing traffic to a dead node and the outage can go unnoticed until users complain. The attack is unauthenticated, network-reachable and trivial (CVSS 7.5), though there is currently no public exploit, no Nuclei template, no KEV listing and no EPSS score, so exploitation is not yet observed. Upgrade to vLLM 0.31.0 or later, and until then block or restrict access to /inference/v1/generate and add a synthetic generation probe to health monitoring rather than relying on /health.

Is CVE-2026-114051 actively exploited?

No confirmed active exploitation of CVE-2026-114051 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-114051?

1) Upgrade vLLM to 0.31.0 or later. 2) Until patched, do not expose the vLLM server directly to untrusted networks; place it behind an authenticating API gateway and restrict /inference/v1/generate to trusted callers. 3) At the gateway or proxy, validate request bodies and reject requests where max_tokens is null or min_tokens is unreasonably large or exceeds max_tokens. 4) Replace or supplement /health checks with a synthetic end-to-end generation probe with a timeout so hung engines are detected and restarted automatically. 5) Monitor logs for uncaught VLLMValidationError in the EngineCore input thread, stalled request queues and rising request latency, and configure automatic process restart on those signals. 6) Apply rate limiting per client.

What systems are affected by CVE-2026-114051?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference servers, RAG pipelines, agent frameworks, batch inference pipelines.

What is the CVSS score for CVE-2026-114051?

CVE-2026-114051 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.38%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inference serversRAG pipelinesagent frameworksbatch inference pipelines

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.

Exploitation Scenario

An attacker discovers an exposed vLLM inference endpoint, for example through internet scanning or a leaked internal URL. They send one POST to /inference/v1/generate with max_tokens set to null and min_tokens set to an oversized value. The validation check is skipped, the request reaches the engine, and the EngineCore input thread crashes on the uncaught VLLMValidationError. The HTTP server and /health endpoint keep responding, so monitoring shows the node healthy while every subsequent generation request hangs. The attacker can repeat the request against any restarted instance to keep the service down.