VDB
CVE-2026-71486
CVE-2026-71486
PUBLISHED
CVSS 4.300000190734863 MEDIUM
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
EPSS 0.37% · 31.3th percentile
Risk Scores
CVSS 3.1
4.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS Score
0.37%
31.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| vllm-project | vllm | 0 |
| PyPI | vllm | 0 |
| chainguard | lmcache-cuda-12.8 | * |
Timeline
- Aug 17, 2026 CVE Published
- Aug 18, 2026 Coalition ESS Score
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 4, 2026 CVE Updated
- Sep 4, 2026 EPSS Score
- Sep 5, 2026 Security Advisory
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-71486 advisory
- https://github.com/advisories/GHSA-8737-qx52-hjff advisory
- https://github.com/vllm-project/vllm/security/advisories/GHSA-8737-qx52-hjff url
- https://github.com/vllm-project/vllm/pull/47260 patch
- https://github.com/vllm-project/vllm/commit/8e61b646e2d157f9b93451fa048f9c8530c8a67b patch
- https://github.com/vllm-project/vllm/releases/tag/v0.26.0 url