CVE-2026-114051: vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate

Q: Which deployments are exposed to remote exploitation?

Deployments running vLLM before 0.31.0 that expose the /inference/v1/generate endpoint to unauthenticated remote users are exposed. No authentication or user interaction is required.

Q: What request is needed to trigger the denial of service?

An attacker can send a single /inference/v1/generate request with max_tokens set to null and an oversized min_tokens value. This bypasses the min_tokens <= max_tokens validation check and causes an uncaught VLLMValidationError.

Q: How does the service behave after exploitation, and can health checks detect it?

The EngineCore input thread dies, causing subsequent generation requests to hang until the service is manually restarted. The /health endpoint may still return HTTP 200, so a successful health-check response does not confirm that generation remains functional.

Q: What can be done if upgrading is not immediately possible?

Restrict unauthenticated access to /inference/v1/generate, particularly from untrusted remote clients. Monitor actual generation-request behavior rather than relying only on /health, and manually restart affected instances to restore service.

Published Oct 21, 2026

Updated

vLLM before 0.31.0 skips the mintokens <= maxtokens check for /inference/v1/generate requests with a null maxtokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized mintokens to hang all subsequent generation requests until manual restart.

Affected Software

1 affected component

vllm vllm<0.31.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

Deployments running vLLM before 0.31.0 that expose the /inference/v1/generate endpoint to unauthenticated remote users are exposed. No authentication or user interaction is required.

What request is needed to trigger the denial of service?

An attacker can send a single /inference/v1/generate request with max_tokens set to null and an oversized min_tokens value. This bypasses the min_tokens <= max_tokens validation check and causes an uncaught VLLMValidationError.

How does the service behave after exploitation, and can health checks detect it?

The EngineCore input thread dies, causing subsequent generation requests to hang until the service is manually restarted. The /health endpoint may still return HTTP 200, so a successful health-check response does not confirm that generation remains functional.

What can be done if upgrading is not immediately possible?

Restrict unauthenticated access to /inference/v1/generate, particularly from untrusted remote clients. Monitor actual generation-request behavior rather than relying only on /health, and manually restart affected instances to restore service.

CVE-2026-114051: vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What request is needed to trigger the denial of service?

How does the service behave after exploitation, and can health checks detect it?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What request is needed to trigger the denial of service?

How does the service behave after exploitation, and can health checks detect it?

What can be done if upgrading is not immediately possible?