CVE-2026-105759

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus's Family::get_or_create function to permanently create counter and histogram label sets. Those label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted. This issue is fixed in version 0.30.0.

• CWE-400

• https://github.com/vllm-project/vllm/commit/3735c2d5f5248259482b9045c34fb7a8a3892352
• https://github.com/vllm-project/vllm/pull/56058
• https://github.com/vllm-project/vllm/releases/tag/v0.30.0
• https://github.com/vllm-project/vllm/security/advisories/GHSA-5fj9-pfhr-6j48
• https://github.com/vllm-project/vllm/security/advisories/GHSA-5fj9-pfhr-6j48

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105753vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-105754vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-105755vLLM is an inference and serving engine for large language m…4.2
• CVE-2026-105756vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-105757vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-105758vLLM is an inference and serving engine for large language m…5.3
• CVE-2026-105760vLLM is an inference and serving engine for large language m…5.3
• CVE-2026-105761Dify is an open-source LLM app development platform. Prior t…7.1
• CVE-2026-105762Dify is an open-source LLM app development platform. Prior t…8.3
• CVE-2026-105763Twenty is an open-source CRM (customer relationship manageme…9.6
• CVE-2026-105764Immich is a high-performance self-hosted photo and video man…7.7
• CVE-2026-105766Use of the backend-facing $scheme variable in the trailing-s…3.1