{"uuid": "07636497-4c82-47e8-a3c2-2c7353045143", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73559", "type": "seen", "source": "https://gist.github.com/alon710/8cc39c03d7f0aab8c747b6a46222fd6c", "content": "# CVE-2026-73559: CVE-2026-73559: Uncontrolled Resource Consumption in vLLM API completions\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-13\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73559\n\n## Summary\nCVE-2026-73559 is an uncontrolled resource consumption vulnerability in the vLLM engine, specifically within the /v1/completions API endpoint, allowing authenticated attackers to cause application-level denial of service via unbounded prompt arrays.\n\n## TL;DR\nvLLM is vulnerable to memory and queue exhaustion via unbounded prompt arrays in the completions API, fixed in v0.26.0.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.5\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: PoC / Theoretical\n\n## Affected Systems\n\n- vLLM Engine\n- **vllm**: >= 0.19.0, < 0.26.0 (Fixed in: `0.26.0`)\n\n## Mitigation\n\n- Upgrade vLLM to version 0.26.0 or later\n- Implement request size filtering at the API Gateway level\n- Configure VLLM_MAX_COMPLETION_PROMPTS to a low threshold\n\n**Remediation Steps:**\n1. Verify current vLLM version using pip show vllm\n2. Upgrade to the patched release via pip install --upgrade vllm>=0.26.0\n3. Restart the vLLM service process to apply changes\n\n## References\n\n- [vLLM Security Advisory](https://github.com/vllm-project/vllm/security/advisories/GHSA-87x5-vmc3-756j)\n- [vLLM Pull Request #47845](https://github.com/vllm-project/vllm/pull/47845)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73559) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-13T19:32:34.136744Z"}