CVE-2026-105759: vLLM Inference Engine DOS Vulnerability

CVE-2026-105759 Overview

CVE-2026-105759 is a resource exhaustion vulnerability [CWE-400] in vLLM, an inference and serving engine for large language models. The flaw resides in the Rust frontend's track_http_metrics middleware, which records raw HTTP method tokens as Prometheus labels. An unauthenticated remote attacker can send requests with arbitrary method tokens to unguarded routes such as /tokenize, causing Family::get_or_create to permanently allocate counter and histogram label sets. Each unique token enlarges the in-memory label cardinality and the /metrics response body. The issue is fixed in vLLM 0.30.0.

Critical Impact
Unauthenticated attackers can exhaust process memory and degrade the /metrics monitoring endpoint until the vLLM service becomes unresponsive.

Affected Products

vLLM inference and serving engine
vLLM Rust frontend (track_http_metrics middleware)
All vLLM versions prior to 0.30.0

Discovery Timeline

2026-10-05 - CVE-2026-105759 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105759

Vulnerability Analysis

The vulnerability stems from unbounded cardinality in Prometheus metric labels. The Rust frontend middleware extracts the HTTP method directly from the incoming request and uses the raw string as a label value. Prometheus's Family::get_or_create function creates and retains a new counter and histogram pair for every previously unseen label combination. Because HTTP method tokens are attacker-controlled on routes that lack method guards, the label set grows without bound.

Each new method token produces persistent metric series in memory. The /metrics endpoint response grows linearly with the number of unique tokens observed. Over time this exhausts process memory and may saturate the monitoring data path, degrading or crashing the inference service.

Root Cause

The root cause is missing normalization of HTTP method labels before they are passed to the Prometheus metric family. Standard HTTP methods are a small, bounded set, but the parser accepts any token-form method per RFC 7230. Without an allowlist or canonicalization step, the label dimension is effectively unbounded and controlled by remote clients.

Attack Vector

An unauthenticated attacker sends HTTP requests with unique custom method tokens to a route registered in the vLLM Rust frontend, such as /tokenize. The attacker iterates distinct tokens (for example, randomly generated strings) to force creation of new Prometheus label sets. Repeated requests enlarge the metrics registry until memory is exhausted or /metrics scrapes time out.

rust

 use std::time::Instant;
 
 use axum::extract::{MatchedPath, Request};
+use axum::http::Method;
 use axum::middleware::Next;
 use axum::response::Response;
 use vllm_metrics::{HttpHandlerLabels, HttpRequestLabels, METRICS};

Source: GitHub Commit 3735c2d. The patch imports axum::http::Method to normalize the method value against the standard enum before it is used as a Prometheus label.

Detection Methods for CVE-2026-105759

Indicators of Compromise

Steadily growing resident memory on vLLM Rust frontend processes without a corresponding increase in legitimate request volume.
Unusually large /metrics response payloads containing counters and histograms labeled with non-standard HTTP method strings.
Access logs on routes such as /tokenize showing requests with uncommon method tokens (random alphanumeric strings, non-RFC method names).

Detection Strategies

Parse Prometheus /metrics output and alert when the cardinality of the method label exceeds the standard set (GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS).
Monitor HTTP access logs for method values outside the standard allowlist and correlate with source IP to identify scanning behavior.
Track process memory and metric scrape duration for vLLM frontends; sustained growth without matching request rate indicates label-cardinality abuse.

Monitoring Recommendations

Set resource limits and alerts on the vLLM service container memory to detect gradual exhaustion.
Enable rate limiting at an upstream proxy and log rejected method tokens for review.
Scrape /metrics on an isolated internal network only, and alert on response-body size regressions.

How to Mitigate CVE-2026-105759

Immediate Actions Required

Upgrade vLLM to version 0.30.0 or later, which normalizes HTTP method labels before passing them to the Prometheus registry.
Restrict exposure of the vLLM Rust frontend behind an authenticated reverse proxy that enforces an HTTP method allowlist.
Audit /metrics responses on running instances and restart affected processes to clear accumulated label sets.

Patch Information

The fix is included in vLLM 0.30.0. See the GitHub Release v0.30.0, the GitHub Security Advisory GHSA-5fj9, the merged GitHub Pull Request #56058, and the corresponding GitHub Commit 3735c2d.

Workarounds

Deploy a reverse proxy (for example, NGINX or Envoy) in front of vLLM that rejects any request whose HTTP method is not in a standard allowlist.
Block external access to the /metrics endpoint and expose it only to trusted monitoring infrastructure.
Apply strict rate limiting on unauthenticated routes such as /tokenize to slow cardinality growth until the patch is deployed.

bash

# NGINX example: allow only standard HTTP methods to reach the vLLM upstream
location / {
    if ($request_method !~ ^(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)$) {
        return 405;
    }
    proxy_pass http://vllm_backend;
}

# Restrict /metrics to internal monitoring subnet
location /metrics {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://vllm_backend;
}