CVE-2026-105759

vLLM is an inference and serving engine for large language models.

Vllm

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus's Family::get_or_create function to permanently create counter and histogram label sets. Those label sets increase process…

6. Okt 2026

Ausgewertete Quellen

• NVD
  CVE-2026-105759
• GitHub
  https://github.com/vllm-project/vllm/security/advisories/GHSA-5fj9-pfhr-6j48