{"id":"CVE-2026-114051","kind":"vulnerability","aliases":["CVE-2026-114051"],"related":[],"title":"vLLM: one malformed request halts all generation until restart","description":"vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.","summary":"vLLM before 0.31.0 skips a token-limit validation check on /inference/v1/generate when max_tokens is null, so the engine's input thread crashes on an uncaught error. An unauthenticated remote attacker can send one request with an oversized min_tokens value to stop every later generation request until the service is restarted manually.","severity":"high","cvss":7.5,"epss":0.00375,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","inference-server","llm-serving","python","self-hosted","vllm"],"not_affected_if":["endpoint-not-exposed","patched-0.31.0-or-later"],"how_to_check":"- Run `pip show vllm` or `python -c \"import vllm; print(vllm.__version__)\"` on the serving host and compare against `0.31.0`\n- Check whether the /inference/v1/generate endpoint is reachable from untrusted networks\n- Confirm /health still returns 200 after a crash by reviewing deployment health checks, which would not detect this failure","fix":"- Upgrade vLLM to `0.31.0` or later\n- Until upgraded, restrict access to /inference/v1/generate to trusted clients or block it at the gateway\n- Add a liveness check that exercises generation, not just /health, so a hung engine gets restarted automatically","status":"open","published_at":"2026-10-21T01:17:27+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:17:07+00:00","updated_at":"2026-10-25T03:17:07+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:17:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vLLM to `0.31.0` or later\n- Until upgraded, restrict access to /inference/v1/generate to trusted clients or block it at the gateway\n- Add a liveness check that exercises generation, not just /health, so a hung engine gets restarted automatically","reach":"internet","title":"vLLM: one malformed request halts all generation until restart","impact":"medium","summary":"vLLM before 0.31.0 skips a token-limit validation check on /inference/v1/generate when max_tokens is null, so the engine's input thread crashes on an uncaught error. An unauthenticated remote attacker can send one request with an oversized min_tokens value to stop every later generation request until the service is restarted manually.","category":"ai-tooling","nicknames":[],"who_cares":["vllm","python","self-hosted","inference-server","llm-serving"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote attacker halts all generation requests until manual restart","analyst_note":"Check the vLLM 0.31.0 release notes or the NVD entry for CVE-2026-114051 to confirm the exact affected endpoint behaviour and whether any non-default setting is required.","how_to_check":"- Run `pip show vllm` or `python -c \"import vllm; print(vllm.__version__)\"` on the serving host and compare against `0.31.0`\n- Check whether the /inference/v1/generate endpoint is reachable from untrusted networks\n- Confirm /health still returns 200 after a crash by reviewing deployment health checks, which would not detect this failure","needs_analyst":true,"not_affected_if":["patched-0.31.0-or-later","endpoint-not-exposed"],"who_is_affected":"Any deployment running vLLM older than 0.31.0 with the /inference/v1/generate endpoint exposed to clients that can reach it. Deployments where that endpoint is only reachable from trusted internal callers, or that run a patched version, can skip this. The sources do not say whether the flaw depends on a non-default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":3392,"output_tokens":737,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114051':12A,15A '-2026':11A,14A '/health':114C '/inference/v1/generate':41B,95C '0.31.0':32B,86C '200':117C 'ai':17B 'ai-tool':16B 'attack':61B,120C 'check':39B,93C 'crash':53B 'cve':10A,13A 'die':108C 'engin':49B 'enginecor':104C 'error':57B 'everi':74B 'generat':7A,76B,134C 'halt':5A 'hang':131C 'host':28B 'infer':20B 'inference-serv':19B 'input':51B,105C 'later':75B,107C 'limit':37B 'llm':23B 'llm-serv':22B 'malform':3A 'manual':83B,137C 'max':43B,91C,100C 'min':69B,89C,128C 'null':46B,99C 'one':2A,64B,123C 'overs':68B,127C 'python':25B 'remot':60B,119C 'request':4A,65B,77B,96C,124C,135C 'restart':9A,82B,138C 'return':116C 'self':27B 'self-host':26B 'send':63B,122C 'serv':24B 'server':21B 'servic':80B 'skip':33B,87C 'still':115C 'stop':73B 'subsequ':133C 'thread':52B,106C 'token':36B,44B,70B,90C,92C,101C,129C 'token-limit':35B 'tool':18B 'unauthent':59B,118C 'uncaught':56B,111C 'valid':38B 'valu':71B 'vllm':1A,29B,30B,84C 'vllmvalidationerror':112C","nicknames":[],"mitigations":[],"who_affected":"Any deployment running vLLM older than 0.31.0 with the /inference/v1/generate endpoint exposed to clients that can reach it. Deployments where that endpoint is only reachable from trusted internal callers, or that run a patched version, can skip this. The sources do not say whether the flaw depends on a non-default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114051","severity":null,"published_at":"2026-10-21T01:17:27+00:00","modified_at":"2026-10-22T15:44:59+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114051","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114051","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}