CVE-2026-9540: vllm-project vllm OpenAI-compatible Serving Path denial of service
A vulnerability was identified in vllm-project vllm 0.19.0. This issue affects some unknown processing of the component OpenAI-compatible Serving Path. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9540?
The severity of CVE-2026-9540 is rated as medium with a score of 5.5.
What type of vulnerability is CVE-2026-9540?
CVE-2026-9540 is a denial of service vulnerability affecting the OpenAI-compatible Serving Path in vllm-project vllm.
How does CVE-2026-9540 affect vllm-project vllm?
CVE-2026-9540 allows for remote exploitation that can lead to a denial of service condition.
Is there a known exploit for CVE-2026-9540?
Yes, an exploit for CVE-2026-9540 is publicly available and might be used in attacks.
How can I mitigate CVE-2026-9540?
To mitigate CVE-2026-9540, it is recommended to update to the latest version of vllm or apply any available security patches.