Uncaught Exception Affecting vllm package, versions [,0.31.0)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-VLLM-21347783
- published21 Oct 2026
- disclosed21 Oct 2026
- creditCen Zhang
Introduced: 21 Oct 2026
NewCVE-2026-114051 (opens in a new tab)How to fix?
Upgrade vllm to version 0.31.0 or higher.
Overview
vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs
Affected versions of this package are vulnerable to Uncaught Exception via _verify_args in vllm/sampling_params.py, which skips the min_tokens <= max_tokens validation when max_tokens is null on /inference/v1/generate requests. An attacker sends a single request with max_tokens set to null and min_tokens set to an oversized value (e.g. 2147483648), causing the EngineCore input thread in process_input_sockets to die on an uncaught VLLMValidationError when it later rebuilds SamplingParams with both values present. The thread is the sole reader of the input socket, so all subsequent generation requests hang indefinitely while /health continues to return 200, requiring a manual restart to recover.
Note: This is only exploitable when the /inference/v1/generate endpoint is reachable, which is mounted by default in v0.29.0 and on main when VLLM_ENABLE_SCALE_OUT_ENDPOINTS=1 or --tokens-only is set, and is unauthenticated unless --api-key is configured.