THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-87x5-vmc3-756j (medium) — vLLM: Completion prompt lists fan out into unbounded engine requests

[GHSA] GHSA-87x5-vmc3-756j (medium) — vLLM: Completion prompt lists fan out into unbounded engine requests

highgithub_advisoriesPublished 2026-08-13

GHSA-87x5-vmc3-756j Severity: medium CVE: CVE-2026-73559

vLLM: Completion prompt lists fan out into unbounded engine requests

## Summary

The `/v1/completions` request model accepts `prompt` as a list of text prompts or a list of token-id prompts without any outer prompt-count bound. The serving path turns each element into a separate engine input, creates one engine generator per element, merge

Indicators of compromise

cbe9c40f998f13975b967773ac7e7920e115387fsha1
CVE-2026-73559cve

Original source: https://github.com/advisories/GHSA-87x5-vmc3-756j