CVE-2026-73559: 
vLLM vulnerability analysis and mitigation

CVE-2026-73559 is a Denial of Service vulnerability in vLLM, an inference and serving engine for large language models, caused by unbounded prompt list fan-out in the /v1/completions endpoint. Affecting versions >= 0.19.0 and < 0.26.0, the flaw allows an authenticated API client to exhaust server resources — CPU, memory, async scheduling capacity, engine request slots, and response buffering — with a single crafted request. The vulnerability was published on August 13, 2026, with the advisory originally filed on July 27, 2026, and is fixed in version 0.26.0. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Feedly).

The root cause is uncontrolled resource consumption (CWE-400 / CWE-770) in vllm/entrypoints/openai/completion/protocol.py, where CompletionRequest.prompt accepts an unbounded list[str] or list[list[int]] without any outer prompt-count validation. The prompt_to_seq() function in vllm/renderers/inputs/preprocess.py passes list-shaped inputs through unchanged, and OnlineRenderer.preprocess_completion() in vllm/renderers/online_renderer.py expands every element. Critically, vllm/entrypoints/openai/completion/serving.py then creates one engine generator and one response slot per prompt element, meaning a single HTTP request can spawn an attacker-chosen number of backend subrequests. The existing validator only checks that some prompt-like input is present, not that the list length is bounded (Github Advisory, Security Advisory).

Successful exploitation causes a Denial of Service affecting the availability of the vLLM inference server. An authenticated attacker can send a single /v1/completions request with a massive prompt list (e.g., tens or hundreds of thousands of short entries), causing the server to allocate, preprocess, schedule, merge, and buffer one subrequest per entry, exhausting CPU, memory, async task scheduling, engine request slots, and response buffering. This can starve or disrupt other tenants sharing the same vLLM server. There is no confidentiality or integrity impact, and no code execution is possible via this vulnerability (Github Advisory).

A proof-of-concept (PoV) is included in the public security advisory, demonstrating that a minimal oversized request with a large prompt array and small max_tokens=1 is sufficient to trigger the issue. The NVD SSVC assessment classifies exploitation status as "poc" and notes the attack is not automatable (requires low-privilege authentication). The EPSS score is approximately 0.388% (32nd percentile), indicating a relatively low near-term exploitation probability. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory, Feedly).

1. Obtain API access: Acquire valid API credentials for a vLLM instance running version >= 0.19.0 and < 0.26.0 with the /v1/completions endpoint exposed.
2. Craft a malicious request: Construct a JSON payload with a large prompt list containing thousands of short string entries and minimal generation parameters to maximize resource consumption per token of output:

{
  "model": "served-model",
  "prompt": ["x", "x", "x", ... ],
  "max_tokens": 1,
  "n": 1
}

3. Alternatively, use token-id lists: The same attack applies using a list of token-id arrays:

{
  "model": "served-model",
  "prompt": [[1], [1], [1], ...],
  "max_tokens": 1,
  "n": 1
}

4. Send the request: Submit the crafted POST request to the /v1/completions endpoint with valid authentication headers.
5. Resource exhaustion: The server expands each prompt element into a separate engine generator and response slot, exhausting CPU, memory, and async scheduling capacity, causing the service to become unavailable to other users (Github Advisory, Security Advisory).

• Network: Unusually large POST requests to /v1/completions with oversized JSON bodies; requests where the prompt field contains arrays with thousands of elements.
• Logs: vLLM access logs showing single requests that spawn an abnormally high number of engine generators or response slots; requests with prompt list lengths in the thousands or higher.
• Process/Resource: Sudden spikes in CPU and memory utilization on the vLLM server process following a single API request; async task queue saturation; engine request slot exhaustion visible in vLLM metrics.
• Application: VLLMValidationError messages referencing "prompt list length exceeds the maximum" (on patched versions, indicating attempted exploitation); degraded or unresponsive /v1/completions endpoint affecting all concurrent users (Github Advisory).

Upgrade vLLM to version 0.26.0 or later, which introduces a validate_prompt_list_length model validator that rejects prompt lists exceeding a configurable maximum before any backend generator is created (vLLM v0.26.0 Release, Fix Commit). The default limit is 1024 prompts per request, configurable via the VLLM_MAX_COMPLETION_PROMPTS environment variable. As a workaround for those unable to upgrade immediately, restrict API access to trusted clients only, implement an API gateway or reverse proxy with request body size limits, and monitor for requests with abnormally large prompt arrays (Github Advisory).