{
 "id": "AIR-2026-0233",
 "slug": "cve-2026-105759-vllm-prometheus-metrics-memory-exhaustion-vu",
 "title": "CVE-2026-105759: vLLM Prometheus Metrics Memory Exhaustion Vulnerability",
 "summary": "The vLLM Rust frontend middleware records raw HTTP method tokens as Prometheus metrics labels without validation. Unauthenticated attackers can send arbitrary method tokens to exhaust server memory and trigger denial of service.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "vLLM"
 ],
 "incident_date": "2026-10-05",
 "incident_date_precision": "day",
 "first_reported": "2026-10-05",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105759",
   "publisher": "NVD",
   "title": "CVE-2026-105759: vLLM is an inference and serving engine for large language models.",
   "published_at": "2026-10-05"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-105759",
  "vllm",
  "memory-exhaustion"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}