CVE-2026-71486: vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generateresponses, choices, tokenids, promptlogprobs, logprobs.content, toplogprobs, and routedexperts structures are processed by OnlineDerenderer and tokenizer.decode before maxmodellen, maxtokens, maxnumseqs, or response-size limits are enforced, allowing an authenticated API client to consume excessive CPU and memory and produce oversized responses. This issue is fixed in version 0.26.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vLLM derender endpoints (/v1/completions/derender and /v1/chat/completions/derender)to a version that resolves this vulnerability.Fixed in 0.26.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71486?
The severity of CVE-2026-71486 is medium with a score of 4.3.
What does CVE-2026-71486 affect?
CVE-2026-71486 affects vLLM's /v1/completions/derender and /v1/chat/completions/derender endpoints.
How do I fix CVE-2026-71486?
To fix CVE-2026-71486, update vLLM to version 0.26.0 or higher.
What kind of attack can CVE-2026-71486 lead to?
CVE-2026-71486 can lead to unbounded processing of caller-supplied token IDs, which may result in denial of service.
Is CVE-2026-71486 related to data exposure?
CVE-2026-71486 does not involve exposure of confidential information as it primarily affects system availability.