CVE-2026-105757
Description
A flaw was found in vLLM. A remote authenticated attacker can cause a Denial of Service (DoS) by submitting specially crafted structured-output requests. Due to improper exception handling around structured-output processing, certain request-level errors fail to be contained and propagate directly into the core engine. This unhandled failure triggers a fatal error that terminates the shared engine process, disrupting service for all active and subsequent users.
Statement
A moderate-impact denial of service flaw was found in the vLLM inference and serving engine, as shipped in Red Hat AI Inference Server 3, Red Hat Enterprise Linux AI, and Red Hat OpenShift AI (RHOAI). A remote attacker with standard authenticated access to the vLLM API can submit specially crafted structured-output (constrained-generation) requests. Due to improper exception handling around structured-output processing — for example a grammar compilation failure re-raised on a latched backend, negative draft-token padding from the ngram_gpu speculative-decoding mode reaching guidance validation, or empty structured-output values admitted by the Rust frontend that the Python frontend rejects — request-level errors are not contained per request but propagate uncaught into the shared EngineCore process, which treats them as fatal and terminates. This disrupts service for all concurrent and subsequent users of the engine until it is restarted. Red Hat rates this flaw Moderate severity (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), consistent with the upstream assessment. The affected Red Hat AI Inference Server 3, Red Hat Enterprise Linux AI, and Red Hat OpenShift AI streams are marked AFFECTED with the fix deferred because the severity is Moderate with a CVSS score below 7.0; the residual risk is that an authenticated API client can terminate the shared engine process, causing denial of service for all users until the service is restarted.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Read Application Data
An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information, or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
