What is CVE-2026-73559?
CVE-2026-73559 is a vulnerability in vLLM where the `/v1/completions` endpoint’s `prompt` field in `CompletionRequest` accepts an unbounded list, affecting versions 0.19.0 through 0.26.0. This can lead to resource exhaustion in the `prompt_to_seq()` function within the input preprocessing renderer. Upgrading to the latest patched version is recommended to mitigate this issue.
Azərbaycanca: CVE-2026-73559 vLLM mühərrikində `/v1/completions` sorğusunda `prompt` sahəsinin limitsiz ölçüdə verilən qəbul etməsi ilə bağlı zəiflikdir. Bu, 0.19.0-dan 0.26.0-a qədər versiyalara təsir edir və `prompt_to_seq()` funksiyasında resurs tükənməsi riski yaradır. Təhlükəsizlik üçün vLLM-i ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-400
FAQ2
In which function of vLLM does CVE-2026-73559 pose a risk of resource exhaustion?
CVE-2026-73559 poses a risk of resource exhaustion in the `prompt_to_seq()` function within the vLLM engine.
What measure is recommended to mitigate CVE-2026-73559?
Upgrading vLLM to the latest patched version is recommended to mitigate CVE-2026-73559.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.