CVE-2026-105759: vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust fronten…
- Occurred
- Oct 5, 2026
- Published
- Oct 5, 2026
- Source
- NVD CVE
Summary
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus's Family::get_or_create function to permanently create counter and histogram label sets. Those label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted. This issue is fixed in version 0.30.0.
Tags
- CVE
- CVE-2026-105759
- cvss:MEDIUM
Classification
Rationale: CVE describes a denial-of-service vulnerability in vLLM inference engine causing memory exhaustion via label injection.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8