CVE-2026-34756: vLLM Unauthenticated Denial of Service via Parameter

# CVE-2026-34756: vLLM Unauthenticated Denial of Service via Parameter

https://gcdradar.vercel.app/incidents/cve-2026-34756-vllm-unauthenticated-denial-of-service-via-pa · AIR-2026-0549 · closed 2026-04-03

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-04-03
- AI role: Attack on AI
- Products: vLLM
- CVE ids: CVE-2026-34756
- CVSS: 6.5

## Summary

An unauthenticated denial of service vulnerability in vLLM allows attackers to crash the server via memory exhaustion by supplying an unbounded parameter. Maintainers have addressed the issue in recent updates.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-04-06: CVE-2026-34756: vLLM is an inference and serving engine for large language models (LLMs). (https://nvd.nist.gov/vuln/detail/CVE-2026-34756)
- 2026-04-03: CVE-2026-34756: vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server (https://github.com/advisories/GHSA-3mwp-wvh9-7528)

## Sources

- 2026-04-03 GitHub Advisory Database: CVE-2026-34756: vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server https://github.com/advisories/GHSA-3mwp-wvh9-7528
- 2026-04-06 NVD: CVE-2026-34756: vLLM is an inference and serving engine for large language models (LLMs). https://nvd.nist.gov/vuln/detail/CVE-2026-34756

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.