CVE-2026-73559

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded liststr or listlistint, prompttoseq in vllm/renderers/inputs/preprocess.py and...

CVE-2026-73559

CVE-2026-73559 affects vLLM (0.19.0–0.26.0) where the /v1/completions prompt field can be an unbounded list, and prompt_to_seq/remove expansion in preprocessing may spawn unbounded expansion and create one engine generator/response slot per prompt. This can exhaust CPU, memory, async scheduling c...