{
 "id": "AIR-2026-0204",
 "slug": "cve-2026-100651-vllm-omits-prompt-length-validation-on-disag",
 "title": "CVE-2026-100651: vLLM omits prompt-length validation on disaggregated endpoint",
 "summary": "vLLM fails to validate decoder prompt length against model configurations on its disaggregated serving endpoint for specific multimodal payloads. The oversight can lead to improper request processing and stability issues.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "vLLM"
 ],
 "incident_date": "2026-09-26",
 "incident_date_precision": "day",
 "first_reported": "2026-09-26",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100651",
   "publisher": "NVD",
   "title": "CVE-2026-100651: vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate.",
   "published_at": "2026-09-26"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-100651",
  "vllm",
  "input-validation"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}