CVE-2026-105757: Vllm

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust frontend can admit empty structured-output values that the Python frontend rejects, allowing ordinary constrained-generation requests to terminate the shared engine. This issue is fixed in version 0.30.0.

Affected products

• Vllm Vllm: before 0.30.0 (fixed in 0.30.0)

Published 2026-10-05. Last modified 2026-10-08.