CVE-2026-105757: 
NixOS vulnerability analysis and mitigation

CVE-2026-105757 is a denial-of-service vulnerability in vLLM, an inference and serving engine for large language models, where structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. Three distinct exploitation sites exist: a latched-backend grammar compilation exception escape (Site 1), negative -1 padding tokens from ngram_gpu speculative decoding passed to guidance validation (Site 2), and the Rust frontend admitting empty structured-output values that the Python frontend rejects (Site 3). All versions of vLLM prior to 0.30.0 are affected, with exploitation confirmed on v0.25.1. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Feedly).

The root cause (CWE-20, CWE-248, CWE-755) is the absence of a per-request exception boundary around structured-output grammar and token handling, allowing request-scoped failures to propagate as uncaught exceptions into the shared engine loop. Site 1: StructuredOutputManager permanently latches one backend process-wide; a grammar accepted only via a fallback backend causes the latched xgrammar compiler to raise, the exception is stored in a Future, and the completion check catches only TimeoutError — so Future.result() re-raises during scheduler promotion, triggering _send_engine_dead(). Site 2: The ngram_gpu proposer pads draft-token rows with -1 sentinels; the scheduler forwards the untrimmed row to GuidanceGrammar.validate_tokens(), which passes -1 to the native llguidance matcher, causing an OverflowError treated as fatal. Site 3: The opt-in Rust frontend's TryFrom implementation for WireStructuredOutputsParams maps empty json/grammar strings to constraints without a non-empty check, forwarding them to the engine where they trigger a fatal error. An authenticated attacker with access to the structured-output API can exploit any of these paths with ordinary constrained-generation requests (Github Advisory, vLLM PR #51450).

Successful exploitation results in a complete denial of service for the shared vLLM EngineCore instance — all concurrent and subsequent tenants of that engine are denied service until the engine is restarted. The impact is limited to availability; there is no code execution, memory corruption, or data disclosure. Site 1 affects the default "auto" structured-output backend and requires no special configuration, making it the broadest attack surface; Sites 2 and 3 require specific deployment configurations (guidance backend with ngram_gpu speculative decoding, or the opt-in Rust frontend, respectively) (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the advisory date (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.31% (22nd percentile), indicating a low near-term exploitation probability. Exploitation requires low privileges (authenticated API access) and no user interaction, but the NVD SSVC assessment classifies it as non-automatable with no known exploitation (Github Advisory). The vulnerability was discovered by the "Patch the Planet" collaboration between Trail of Bits and OpenAI, using GPT-5.5-Cyber as part of a security research initiative.

1. Reconnaissance: Identify a vLLM deployment running a version prior to 0.30.0 with the structured-output feature enabled (default in most deployments). Obtain valid API credentials if API-key middleware is in use.
2. Site 1 — Backend compile exception: Send two structured-output requests using a duplicate-root EBNF grammar (e.g., a grammar with two identical root rules). The first request latches the xgrammar backend process-wide; the second request with a grammar only accepted via a fallback backend causes xgrammar to raise a compile exception stored in a Future. During scheduler promotion, Future.result() re-raises the exception (only TimeoutError is caught), propagating it to EngineCore as fatal and triggering _send_engine_dead().
3. Site 2 — Negative token padding (ngram_gpu): On a deployment using the guidance backend with ngram_gpu speculative decoding, send any ordinary constrained-generation request. The ngram_gpu proposer automatically pads draft-token rows with -1 sentinels; the scheduler forwards the untrimmed row to GuidanceGrammar.validate_tokens(), which passes -1 to llguidance, causing an OverflowError treated as engine-fatal.
4. Site 3 — Empty Rust frontend value: On a deployment using the opt-in Rust frontend, send a single structured-output API request with an empty structured_outputs.json or structured_outputs.grammar field (e.g., {"structured_outputs": {"json": ""}}). The Rust TryFrom conversion forwards the empty value without validation, reaching the engine and marking EngineCore dead.
5. Result: The shared EngineCore terminates, denying service to all concurrent and subsequent users of that engine instance until it is manually restarted (Github Advisory, vLLM PR #51450).

• Logs: vLLM engine logs showing _send_engine_dead() being called unexpectedly; uncaught OverflowError or grammar compilation exceptions in the scheduler or engine core logs; Future.result() re-raising non-TimeoutError exceptions during scheduler promotion.
• Process: Sudden termination or restart of the vLLM EngineCore process; all in-flight inference requests failing simultaneously with engine-dead errors.
• Network: Repeated structured-output API requests from a single authenticated client, particularly with unusual EBNF grammars (duplicate root rules), empty json/grammar fields, or requests coinciding with ngram_gpu speculative decoding activity.
• Application Behavior: Complete loss of inference availability for all tenants of the affected engine instance following a specific structured-output request, with no hardware or resource exhaustion explanation (Github Advisory).

Upgrade vLLM to version 0.30.0 or later, which includes the fix via commit c55e15a and PR #51450 (vLLM Release v0.30.0). The fix adds a strip_speculative_padding() utility that removes -1 sentinels in the scheduler before tokens reach any grammar backend (backend-agnostic), and adds a defensive guard in GuidanceGrammar.validate_tokens(). Until patching is complete, consider restricting structured-output API access to trusted users only, disabling the opt-in Rust frontend if not required, and avoiding ngram_gpu speculative decoding with the guidance backend. Implement request-level monitoring to detect and isolate malformed structured-output requests before they reach the engine core (Github Advisory, vLLM PR #51450).

The vulnerability was discovered and reported by the "Patch the Planet" initiative, a collaboration between Trail of Bits and OpenAI using GPT-5.5-Cyber, highlighting the growing use of AI-assisted security research for finding vulnerabilities in AI infrastructure (Github Advisory). The vLLM maintainers responded promptly, with the fix reviewed and merged within weeks of the report. Red Hat tracked the issue via Bugzilla, indicating relevance to enterprise deployments of vLLM. Community discussion was limited, consistent with the moderate severity and lack of active exploitation.