CVE-2026-73559: CVE-2026-73559: Uncontrolled Resource Consumption in vLLM API completions

CVE-2026-73559: Uncontrolled Resource Consumption in vLLM API completions

Vulnerability ID: CVE-2026-73559
CVSS Score: 6.5
Published: 2026-08-13

CVE-2026-73559 is an uncontrolled resource consumption vulnerability in the vLLM engine, specifically within the /v1/completions API endpoint, allowing authenticated attackers to cause application-level denial of service via unbounded prompt arrays.

TL;DR

vLLM is vulnerable to memory and queue exhaustion via unbounded prompt arrays in the completions API, fixed in v0.26.0.

---

Technical Details

• CWE ID: CWE-400
• Attack Vector: Network
• CVSS v3.1: 6.5
• Impact: Denial of Service (DoS)
• Exploit Status: PoC / Theoretical

Affected Systems

• vLLM Engine
• vllm: >= 0.19.0, < 0.26.0 (Fixed in: 0.26.0)

Code Analysis

Commit: 675f429

Add prompt list length validation in completions endpoint using environment variable VLLM_MAX_COMPLETION_PROMPTS

Mitigation Strategies

• Upgrade vLLM to version 0.26.0 or later
• Implement request size filtering at the API Gateway level
• Configure VLLM_MAX_COMPLETION_PROMPTS to a low threshold

Remediation Steps:

1. Verify current vLLM version using pip show vllm
2. Upgrade to the patched release via pip install --upgrade vllm>=0.26.0
3. Restart the vLLM service process to apply changes

References

• vLLM Security Advisory
• vLLM Pull Request #47845

---

Read the full report for CVE-2026-73559 on our website for more details including interactive diagrams and full exploit analysis.