{
 "id": "AIR-2026-0077",
 "slug": "cve-2026-73559-denial-of-service-vulnerability-in-vllm-compl",
 "title": "CVE-2026-73559: Denial of service vulnerability in vLLM completion prompt preprocessing",
 "summary": "Unbounded prompt inputs accepted by the vLLM completions endpoint between versions 0.19.0 and 0.26.0 allow authenticated API clients to exhaust server CPU and memory resources. The flaw leads to asynchronous scheduling capacity degradation.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "vLLM"
 ],
 "incident_date": "2026-08-13",
 "incident_date_precision": "day",
 "first_reported": "2026-08-13",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73559",
   "publisher": "NVD",
   "title": "CVE-2026-73559: vLLM is an inference and serving engine for large language models.",
   "published_at": "2026-08-13"
  },
  {
   "url": "https://github.com/advisories/GHSA-87x5-vmc3-756j",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-73559: vLLM: Completion prompt lists fan out into unbounded engine requests",
   "published_at": "2026-08-13"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-73559",
  "vllm",
  "denial-of-service",
  "resource-exhaustion"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T07:00:14.101Z"
}