vLLM is an inference and serving engine for large language models.
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust frontend can admit empty structured-output values that the Python frontend rejects, allowing ordinary constrained-generation requests to terminate the shared engine. This issue is fixed in version 0.30
Read at NIST National Vulnerability Database (CVE API 2.0)
- Product
- AI / LLM tooling
- CVSS
- 6.5
- Fix
- available
- Exposure class
- AI infrastructure
Why it ranks 13 (Routine)
- CVSS 6.5 medium
- Product class: AI infrastructure
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-105757 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.