CVE-2026-73559

The CVSS 6.5 rating for CVE-2026-73559 understates the operational threat. The vulnerability stems from unbounded prompt list expansion in vLLM that cascades across multiple architectural layers simultaneously—one request triggers proportional resource drain across CPU, memory, async schedulers, engine slots, and response buffers. In deployments already managing GPU memory constraints and latency SLAs, this multiplicative drain is significantly harder to absorb than the CVSS vector implies. The 'authenticated client' requirement is frequently treated as a severity discount, but this assumption breaks down for API-gated inference services. The actual threat surface includes credential theft, compromised API keys, and malicious internal users—all high-frequency incident categories in cloud environments. In multi-tenant vLLM deployments, one compromised credential can degrade service for every tenant sharing the engine. The blast radius extends far beyond the attacker's session, violating the tenant isolation model that makes multi-tenancy viable. The EPSS score of 0.00388 reflects limited external exposure in traditional deployments, but vLLM increasingly runs behind API gateways in cloud AI services where attack surface extends to customers, not just internal users. Do not interpret low EPSS as low priority in those contexts. Version 0.26.0 presumably adds input bounds checking or per-request quotas. Examine what limits were introduced, whether they're configurable, and whether they interact badly with legitimate batch prompting workflows—a common vLLm use case. Consider whether the fix addresses only the /v1/completions endpoint or establishes systemic input validation. At the gateway layer, implement hard per-request element caps and tenant-level resource quotas that cannot be overridden by a single authenticated request. Note that production vLLM deployments are sticky—versions 0.19.0 through 0.25.x will persist in the wild long after the patch releases due to stability requirements and testing cycles. Prioritize identifying which versions you run.

Reviewed through automated stages and approved by a human before publication.