CVE-2026-114051 Overview
CVE-2026-114051 is a denial of service vulnerability in vLLM versions before 0.31.0. The flaw resides in the /inference/v1/generate endpoint, which skips the min_tokens <= max_tokens validation check when max_tokens is null. An unauthenticated remote attacker can submit a single request with an oversized min_tokens value, causing the EngineCore input thread to terminate on an uncaught VLLMValidationError. All subsequent generation requests hang until the service is manually restarted. The /health endpoint continues returning HTTP 200, concealing the broken state from standard liveness probes. The weakness is classified as [CWE-248] Uncaught Exception.
Critical Impact
A single unauthenticated HTTP request can disable all generation functionality in vLLM deployments while health checks continue reporting the service as healthy.
Affected Products
- vLLM inference server versions prior to 0.31.0
- Deployments exposing the /inference/v1/generate endpoint
- Downstream platforms embedding vulnerable vLLM releases
Discovery Timeline
- 2026-10-21 - CVE-2026-114051 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-114051
Vulnerability Analysis
vLLM is a high-throughput inference and serving engine for large language models. The /inference/v1/generate endpoint accepts sampling parameters including min_tokens and max_tokens. Normally the server validates that min_tokens does not exceed max_tokens before dispatching work to the EngineCore worker thread.
When a client supplies a null max_tokens, this guard is bypassed. The request flows into the EngineCore input processing thread, where a downstream check raises a VLLMValidationError. The exception is not caught at the thread boundary, so the input thread exits.
After the thread dies, incoming generation requests queue indefinitely because no consumer processes them. The HTTP server remains responsive and the /health liveness endpoint continues returning 200, which prevents orchestrators such as Kubernetes from automatically restarting the pod.
Root Cause
The root cause is incomplete input validation combined with missing exception handling on a worker thread. The precondition check for min_tokens <= max_tokens is skipped when max_tokens is null, deferring validation to a code path that cannot safely recover from the raised error.
Attack Vector
The attack is network-reachable and requires no authentication beyond whatever the operator exposes on the inference endpoint. An attacker sends one POST request to /inference/v1/generate with max_tokens set to null and min_tokens set to an oversized integer. The EngineCore thread terminates, and the server stops processing further generation traffic until an operator intervenes.
Detection Methods for CVE-2026-114051
Indicators of Compromise
- Generation requests to /inference/v1/generate hanging without responses while /health returns HTTP 200
- Log entries containing VLLMValidationError originating from the EngineCore input thread
- Sudden drop in token throughput metrics without a corresponding container restart or crash signal
- Inbound requests containing JSON bodies with max_tokens: null paired with abnormally large min_tokens values
Detection Strategies
- Inspect inference request payloads at the ingress or API gateway for max_tokens null combined with min_tokens above model context limits
- Correlate stalled queue depth metrics with VLLMValidationError stack traces in application logs
- Add synthetic end-to-end generation probes rather than relying on /health alone to detect liveness
Monitoring Recommendations
- Alert when request latency on /inference/v1/generate exceeds a baseline threshold while health checks still succeed
- Track EngineCore worker thread count and raise an alert if it drops below expected values
- Forward vLLM structured logs to a centralized analytics platform and tag VLLMValidationError events for review
How to Mitigate CVE-2026-114051
Immediate Actions Required
- Upgrade vLLM to version 0.31.0 or later across all inference nodes
- Restrict network exposure of the /inference/v1/generate endpoint to authenticated clients and trusted networks
- Replace shallow /health liveness probes with functional readiness checks that exercise the generation pipeline
Patch Information
The fix is available in vLLM 0.31.0. The patch adds the missing min_tokens <= max_tokens validation path for requests where max_tokens is null and prevents the EngineCore input thread from exiting on validation errors. See the GitHub Security Advisory GHSA-4xqp-c3mv-qff7 and the VulnCheck Denial of Service Advisory for additional detail.
Workarounds
- Deploy a reverse proxy or API gateway rule that rejects requests where max_tokens is null or where min_tokens exceeds the model maximum context length
- Enforce request schema validation at the ingress to require a numeric max_tokens field
- Configure orchestration platforms to restart vLLM pods on sustained request latency rather than relying solely on HTTP health endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
