CVE-2026-114051 vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114051?
CVE-2026-114051 is a high-severity vulnerability in vllm-project vllm, published on 21 Oct 2026.
Official description
vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.
Weakness: CWE-248
Which versions are affected by CVE-2026-114051?
How do I fix CVE-2026-114051?
No fix has been published for CVE-2026-114051 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-114051 being exploited?
There is no known exploitation of CVE-2026-114051 in the wild and no public exploit code.
Sources
Also known as GHSA-4xqp-c3mv-qff7, GHSA-qwv5-gq8g-3jwj.