PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9540 vllm-project CVE debrief

A denial-of-service vulnerability exists in vLLM 0.19.0 affecting the OpenAI-compatible serving path. The issue allows remote attackers to trigger service disruption through unspecified manipulation of the serving component. A fix has been proposed via pull request but awaits maintainer acceptance. The vulnerability is classified as medium severity with a CVSS 4.0 score of 5.5, reflecting network accessibility and low attack complexity with availability impact. The exploit is publicly available, increasing immediate risk for exposed deployments. Organizations running vLLM 0.19.0 with OpenAI-compatible endpoints exposed to untrusted networks should prioritize monitoring for anomalous request patterns and apply the pending patch once merged.

Vendor
vllm-project
Product
vllm
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-07-23
Advisory published
2026-05-26
Advisory updated
2026-07-23

Who should care

Organizations operating vLLM inference services with OpenAI-compatible endpoints exposed to external networks, particularly those serving production workloads where availability is critical. ML platform teams, MLOps engineers, and security teams responsible for AI/ML infrastructure should prioritize this vulnerability given the public exploit availability and pending patch status.

Technical summary

The vulnerability resides in vLLM 0.19.0's OpenAI-compatible serving path, where improper handling of certain requests can lead to resource exhaustion or service disruption. The attack vector is network-based with no authentication required. Root cause appears related to CWE-404 (Improper Resource Shutdown or Release), suggesting inadequate cleanup of connections, streams, or processing threads. The publicly available exploit enables remote attackers to degrade or disable model serving capabilities. Pending pull request #37594 addresses the underlying resource management deficiency.

Defensive priority

medium

Recommended defensive actions

  • Monitor vLLM serving infrastructure for anomalous request patterns that may indicate exploitation attempts
  • Review and restrict network access to vLLM OpenAI-compatible endpoints to trusted sources only
  • Track GitHub pull request #37594 for merge status and apply patch immediately upon release
  • Consider implementing rate limiting and request size constraints as compensating controls
  • Review vLLM issue #37343 for technical details on affected request patterns

Evidence notes

Vulnerability disclosed 2026-05-26 via NVD with VulDB as CNA. Affects vLLM 0.19.0 OpenAI-compatible serving path. CWE-404 (Improper Resource Shutdown or Release) identified. Pull request #37594 submitted for remediation. Exploit status marked as public per CVSS 4.0 vector (E:P).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9540 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9540

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9540 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9540

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.