CVE-2026-9540: vLLM denial of service via compute amplification in OpenAI serving path

Executive brief

vLLM is a high-performance engine for serving large language models (LLMs). A vulnerability in its OpenAI-compatible serving path allows remote attackers to cause a denial of service. This can lead to significant performance degradation or service unavailability, impacting the reliability of AI-powered applications and customer-facing services.

Technical details

vLLM is vulnerable to a denial of service (DoS) due to improper resource shutdown or release (CWE-404) within the OpenAI-compatible serving path. The issue specifically relates to how the scheduler handles requests involving 'n_completions' and 'logprobs' parameters, which can cause significant spikes in Time To First Token (TTFT) for co-scheduled requests on a cold cache. A remote, unauthenticated attacker can exploit this by sending specifically crafted requests that exhaust or mismanage system resources. This results in a partial loss of availability. A fix has been proposed in pull request #37594 to add a batched logprobs budget to the scheduler.

Affected products

• vllm-project vLLM <= 0.19.0

Timeline

• 2026-05-26: disclosed
• 2026-05-26: advisory: Published to GitHub Advisory Database and NVD

References

• https://github.com/vllm-project/vllm/issues/37343
• https://github.com/vllm-project/vllm/pull/37594
• https://github.com/vllm-project/vllm
• https://ingero.io/debugging-vllm-latency-minimax-ollama-mcp
• https://vuldb.com/submit/814645