ByteOS Network

NVD Vulnerability Details :

CVE-2026-9540

Deferred

Source-cna@vuldb.com

Published At-26 May, 2026 | 14:16

Updated At-26 May, 2026 | 19:54

A vulnerability was identified in vllm-project vllm 0.19.0. This issue affects some unknown processing of the component OpenAI-compatible Serving Path. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	5.5	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Secondary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P

Type: Secondary

Version: 4.0

Base score: 5.5

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Type: Primary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Type: Secondary

Version: 2.0

Base score: 5.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:N/I:N/A:P

Weaknesses

CWE ID	Type	Source
CWE-404	Primary	cna@vuldb.com

CWE ID: CWE-404

Type: Primary

Source: cna@vuldb.com

References

Hyperlink	Source	Resource
https://github.com/vllm-project/vllm/	cna@vuldb.com	N/A
https://github.com/vllm-project/vllm/issues/37343	cna@vuldb.com	N/A
https://github.com/vllm-project/vllm/pull/37594	cna@vuldb.com	N/A
https://ingero.io/debugging-vllm-latency-minimax-ollama-mcp/	cna@vuldb.com	N/A
https://vuldb.com/submit/814645	cna@vuldb.com	N/A
https://vuldb.com/vuln/365601	cna@vuldb.com	N/A
https://vuldb.com/vuln/365601/cti	cna@vuldb.com	N/A