CVE-2026-73559 — vLLM: Completion prompt lists fan out into unbounded engine requests

Affected: vllm-project vllm

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded list[str] or list[list[int]], prompt_to_seq() in vllm/renderers/inputs/preprocess.py and OnlineRenderer.preprocess_completion() in vllm/renderers/online_renderer.py expand every element, and vllm/entrypoints/openai/completion/serving.py creates one engine generator and response slot per prompt, allowing an authenticated API client to exhaust CPU, memory, async scheduling capacity, engine request slots, and response buffering with one request. This issue is fixed in version 0.26.0.

PYSEC-2026-3704 — vLLM: Completion prompt lists fan out into unbounded engine requests

Affected: PyPI: vllm

## Summary

The `/v1/completions` request model accepts `prompt` as a list of text prompts or a list of token-id prompts without any outer prompt-count bound. The serving path turns each element into a separate engine input, creates one engine generator per element, merges all generators, and allocates a response slot per prompt. An authenticated API client can therefore turn one request into an attacker-chosen number of backend subrequests before any aggregate request-count budget is enforced.

## Technical Details

`CompletionRequest.prompt` allows both list-shaped prompt inputs and scalar prompts:

```python # vllm/entrypoints/openai/completion/protocol.py prompt: ( list[Annotated[int, Field(ge=0)]] | list[list[Annotated[int, Field(ge=0)]]] | str | list[str] | None ) = None ```

The validator only requires some prompt-like input to be present:

```python def validate_prompt_and_prompt_embeds(cls, data): prompt = data.get("prompt") prompt_embeds = data.get("prompt_embeds") ... if prompt_is_empty and embeds_is_empty: raise VLLMValidationError(...) ```

The renderer then expands list-shaped prompts as a sequence. `prompt_to_seq()` wraps a scalar string or a single token-id list, but returns a `list[str]` or `list[list[int]]` unchanged:

```python # vllm/renderers/inputs/preprocess.py def prompt_to_seq(prompt_or_prompts): if isinstance(prompt_or_prompts, (dict, str, bytes)) or ( len(prompt_or_prompts) > 0 and is_list_of(…

Most recent entries from all

CVE-2026-73559 — vLLM: Completion prompt lists fan out into unbounded engine requests

PYSEC-2026-3704 — vLLM: Completion prompt lists fan out into unbounded engine requests