CVE-2026-105757: vLLM Inference Engine DOS Vulnerability

CVE-2026-105757 Overview

vLLM is an inference and serving engine for large language models. CVE-2026-105757 affects vLLM versions prior to 0.30.0. Structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. Ordinary constrained-generation requests can terminate the shared engine, denying service to all tenants sharing that instance. The flaw is tracked under [CWE-20: Improper Input Validation] and is resolved in vLLM 0.30.0.

Critical Impact
An authenticated user issuing a crafted structured-output request can crash the shared vLLM engine process, causing denial of service for every concurrent inference request routed to that instance.

Affected Products

vLLM inference and serving engine, all versions prior to 0.30.0
Deployments relying on ngram_gpu speculative decoding with structured output
Multi-tenant LLM serving stacks exposing the vLLM Rust frontend

Discovery Timeline

2026-10-05 - CVE-2026-105757 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105757

Vulnerability Analysis

The flaw is an input validation failure in vLLM's structured-output pipeline. Three distinct code paths allow invalid requests to raise exceptions that propagate past per-request handling and into the shared EngineCore fatal-error path. Because EngineCore services every active request, a single malformed structured-output request terminates in-flight generations for all tenants.

The first path is a per-request backend mismatch that re-raises a grammar compilation exception. The second involves padding produced by the ngram_gpu speculative-decoding mode, which passes a negative token identifier to guidance validation. The third stems from inconsistent frontend validation: the Rust frontend admits empty structured-output values that the Python frontend rejects.

Root Cause

The vulnerability stems from exceptions in structured-output validation not being caught at the per-request scope. Instead of marking the single offending request as failed, the engine treats the exception as fatal and tears down the shared process. The patch introduces strip_speculative_padding and tightens validation to isolate failures to the originating request.

Attack Vector

An attacker with low-privilege API access to a vLLM endpoint submits a constrained-generation request that triggers one of the three paths. No user interaction is required. The attack is network-reachable and inexpensive to execute, with high impact to availability of the shared inference engine.

python

# Patch excerpt: vllm/v1/core/sched/scheduler.py
from vllm.v1.spec_decode.dynamic.utils import build_dynamic_sd_schedule_lookup
from vllm.v1.spec_decode.metrics import SpecDecodingStats
from vllm.v1.structured_output import StructuredOutputGrammar, StructuredOutputManager
from vllm.v1.structured_output.utils import strip_speculative_padding
from vllm.v1.utils import record_function_or_nullcontext

logger = init_logger(__name__)
# Source: https://github.com/vllm-project/vllm/commit/c55e15a44ec4127832d4a86928a356fdd9e68dbd

python

# Patch excerpt: vllm/v1/structured_output/backend_guidance.py
from vllm.v1.structured_output.request import get_structured_output_key
from vllm.v1.structured_output.utils import strip_speculative_padding

if TYPE_CHECKING:
    import llguidance
# Source: https://github.com/vllm-project/vllm/commit/c55e15a44ec4127832d4a86928a356fdd9e68dbd

The fixes introduce the strip_speculative_padding helper into both the scheduler and the guidance backend to remove invalid padding tokens before validation.

Detection Methods for CVE-2026-105757

Indicators of Compromise

Repeated EngineCore fatal-error log entries followed by vLLM process restarts
Grammar compilation exceptions surfacing in the engine log for structured-output requests
Guidance validation errors referencing negative token identifiers in ngram_gpu speculative decoding
Requests reaching the Rust frontend with empty structured-output schemas that were previously rejected by the Python frontend

Detection Strategies

Monitor vLLM server availability and track unexpected EngineCore termination events as high-priority alerts.
Instrument the inference API gateway to log request payloads of structured-output requests that precede engine crashes for correlation.
Compare request volume anomalies against engine restart counts to identify a single client triggering repeated outages.

Monitoring Recommendations

Enable verbose logging on the structured-output backend to capture grammar and guidance validation failures.
Export engine process uptime, request error rates, and 5xx responses to a centralized SIEM for trend analysis.
Alert on bursts of HTTP 5xx responses from the vLLM endpoint coinciding with API calls that specify response_format or constrained decoding.

How to Mitigate CVE-2026-105757

Immediate Actions Required

Upgrade vLLM to version 0.30.0 or later on all serving nodes.
Audit upstream API gateways to confirm that only authenticated clients can submit structured-output requests.
Review orchestration health checks so that engine crashes trigger alerts rather than silent restarts.

Patch Information

The fix is released in vLLM v0.30.0. The upstream commit is c55e15a4 and the merged change is tracked in Pull Request #51450. Additional context is available in GitHub Security Advisory GHSA-85xf-c7hm-whqw.

Workarounds

Disable the ngram_gpu speculative-decoding mode until the upgrade is applied.
Route structured-output requests through the Python frontend to benefit from its stricter validation of empty values.
Enforce request-side schema validation at the API gateway to reject empty or malformed structured-output payloads before they reach vLLM.

bash

# Upgrade vLLM to the patched release
pip install --upgrade "vllm>=0.30.0"

# Verify the installed version
python -c "import vllm; print(vllm.__version__)"