CVE-2026-114051

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.31.0

Description An issue exists where the system fails to validate that min tokens is less than or equal to max tokens when the /inference/v1/generate endpoint receives a null max tokens value. This leads to an uncaught VLLMValidationError that causes the EngineCore input thread to crash. Consequently, while the /health endpoint continues to report a healthy status, all subsequent generation requests are hung. Unauthenticated remote attackers can trigger this state by sending a single request with an oversized min tokens value.

Recommendations Update to version 0.31.0 or later. Avoid using an oversized min tokens value in the /inference/v1/generate endpoint.