PYSEC-2026-4199

At a glance

Published
Updated
CVE
CVE-2026-105757
Aliases
GHSA-85xf-c7hm-whqw
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Description

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust frontend can admit empty structured-output values that the Python frontend rejects, allowing ordinary constrained-generation requests to terminate the shared engine. This issue is fixed in version 0.30.0.

Affected packages

PackageVersions
PyPI · vllmintroduced 0, fixed 0.30.0

References

Sources

SourceLicence
OSV.devCC-BY 4.0 — PyPA Advisory Database