CVE-2026-71486: vLLM Inference Engine DoS Vulnerability

CVE-2026-71486 Overview

CVE-2026-71486 affects vLLM, an inference and serving engine for large language models. The /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects and process nested structures before enforcing resource limits. An authenticated API client can submit oversized payloads that consume excessive CPU and memory. The vulnerability is classified as [CWE-400] Uncontrolled Resource Consumption and is fixed in vLLM 0.26.0.

Critical Impact
Authenticated clients can exhaust CPU and memory on vLLM inference servers by submitting crafted derender requests that bypass max_model_len, max_tokens, max_num_seqs, and response-size limits.

Affected Products

vLLM versions prior to 0.26.0
Deployments exposing /v1/completions/derender endpoints
Deployments exposing /v1/chat/completions/derender endpoints

Discovery Timeline

2026-08-17 - CVE-2026-71486 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-71486

Vulnerability Analysis

The vulnerability resides in vLLM's derender endpoints, which reverse-engineer completions from caller-supplied response objects. The endpoints accept GenerateResponse payloads containing generate_responses, choices, token_ids, prompt_logprobs, logprobs.content, top_logprobs, and routed_experts fields. The OnlineDerenderer and tokenizer.decode process these nested structures before any size validation runs.

An authenticated client can submit payloads with unbounded array sizes or extreme token counts. The server allocates memory and spends CPU cycles decoding attacker-controlled data before rejecting the request. This produces oversized responses and degrades service for concurrent users.

Root Cause

The endpoints enforce max_model_len, max_tokens, max_num_seqs, and response-size limits after processing caller input. Validation order is reversed relative to safe request handling. Fields such as token_ids also lacked value validation, permitting negative integers that could trigger downstream errors during decoding.

Attack Vector

Attackers require authenticated API access to a vLLM deployment. They send crafted POST requests to the derender endpoints with inflated nested structures. Repeated requests amplify CPU and memory pressure, producing a partial denial of service for the inference workload.

python

# Security patch: add resource bounds validation to derender endpoints
# vllm/entrypoints/scale_out/token_in_token_out/protocol.py

    # or (b) ``enable_return_routed_experts`` is off server-side.
    routed_experts: str | None = None

    @field_validator("token_ids")
    @classmethod
    def validate_token_ids(cls, v: list[int] | None) -> list[int] | None:
        if v is not None and any(t < 0 for t in v):
            raise ValueError("token_ids must not contain negative values")
        return v


class GenerateResponseStreamChoice(BaseModel):
    index: int

Source: GitHub Commit 8e61b64

Detection Methods for CVE-2026-71486

Indicators of Compromise

Elevated CPU or memory utilization on vLLM inference servers coinciding with requests to /v1/completions/derender or /v1/chat/completions/derender.
HTTP POST requests to derender endpoints containing unusually large generate_responses, choices, token_ids, or logprobs arrays.
Response payloads exceeding configured size expectations from derender endpoints.

Detection Strategies

Instrument the vLLM API layer to log payload sizes and array lengths for derender endpoint requests.
Correlate request rate against per-worker CPU and memory metrics to spot resource exhaustion patterns.
Alert on repeated requests from a single authenticated client that trigger prolonged decode operations.

Monitoring Recommendations

Track request latency and worker saturation for /v1/completions/derender and /v1/chat/completions/derender.
Capture API access logs with authenticated principal identifiers to attribute abusive traffic.
Configure metrics exporters to surface OOM events and process restarts on inference nodes.

How to Mitigate CVE-2026-71486

Immediate Actions Required

Upgrade vLLM to version 0.26.0 or later, which enforces resource bounds on derender endpoints.
Restrict network access to derender endpoints to trusted internal clients only.
Review authentication tokens and revoke any that show evidence of abusive request patterns.

Patch Information

The fix is delivered in vLLM v0.26.0 via Pull Request #47260 and commit 8e61b64. The patch adds field validators for token_ids and enforces max_model_len, max_tokens, max_num_seqs, and response-size limits before invoking OnlineDerenderer and tokenizer.decode. See the GHSA-8737-qx52-hjff advisory for full details.

Workarounds

Place an API gateway or reverse proxy in front of vLLM to enforce request body size limits.
Disable the derender endpoints via ingress rules if they are not required for the deployment.
Apply per-client rate limits to reduce the amplification potential of crafted requests.

bash

# Example: enforce request body limits at an NGINX ingress
client_max_body_size 1m;
location ~ ^/v1/(completions|chat/completions)/derender$ {
    limit_req zone=derender burst=5 nodelay;
    proxy_pass http://vllm_upstream;
}