https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 18:19:37 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-114051 <p>vLLM before 0.31.0 skips the min_tokens &lt;= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.</p> <p>vLLM before 0.31.0 skips the min_tokens &lt;= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.</p> https://db.gcve.eu/vuln/fkie_cve-2026-114051 https://db.gcve.eu/vuln/ghsa-qwv5-gq8g-3jwj <p>vLLM before 0.31.0 skips the min_tokens &lt;= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.</p> <p>vLLM before 0.31.0 skips the min_tokens &lt;= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.</p> https://db.gcve.eu/vuln/ghsa-qwv5-gq8g-3jwj