CVE-2026-105759 vllm-project CVE debrief

Who should care

Defenders who are responsible for the security of systems using vLLM should care about this vulnerability. They should assess their exposure to this vulnerability and prioritize updating to version 0.30.0 or later to prevent this DoS vulnerability.

Why it matters

This vulnerability allows an unauthenticated attacker to cause a DoS attack on systems using vLLM prior to version 0.30.0. Defenders should prioritize updating to version 0.30.0 or later to prevent this vulnerability. They should also monitor their systems for unusual traffic patterns and assess their exposure to this vulnerability.

• Increased process memory usage
• Enlarged /metrics response size
• Potential service or monitoring path exhaustion
• DoS vulnerability allowing unauthenticated attackers to send unique arbitrary method tokens

Technical summary

The vulnerability is caused by the Rust frontend's track_http_metrics middleware recording the raw HTTP method token as a Prometheus label for requests reaching registered routes. This allows an unauthenticated attacker to send unique arbitrary method tokens to unguarded routes, causing Prometheus's Family::get_or_create function to permanently create counter and histogram label sets. These label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted.

Defensive priority

Defenders should prioritize updating to version 0.30.0 or later to prevent this DoS vulnerability. They should also monitor their systems for unusual traffic patterns and assess their exposure to this vulnerability.

Recommended defensive actions

• Update to version 0.30.0 or later
• Monitor systems for unusual traffic patterns
• Assess exposure to this vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The evidence for this vulnerability comes from the official CVE Program record, the NVD vulnerability detail page, and the source item from osv_dev. The CVE Program record provides the official CVE metadata, while the NVD vulnerability detail page provides a source-specific vulnerability assessment. The source item from osv_dev provides additional details about the vulnerability, including the affected versions and the fixed version.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.