CVE-2026-103241 in vLLM
Summary
by MITRE • 09/30/2026
A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 0.29.1rc0 is able to resolve this issue. This patch is called 3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9. Upgrading the affected component is advised.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vLLM project, a high-performance inference and serving engine for large language models, contains a critical vulnerability in versions up to 0.26.0 that impacts the Gemma4UnifiedParser component. This flaw resides within the Rust source file rust/src/parser/src/unified/gemma4.rs and represents a significant risk to system stability when processing specific inputs related to the Google Gemma-4 model architecture. The nature of this vulnerability allows an attacker who can interact with the parser service to trigger a denial of service condition, effectively rendering the inference engine unavailable for legitimate requests. This type of issue is commonly categorized under CWE-20 Improper Input Validation or CWE-787 Out-of-bounds Write depending on the specific memory corruption mechanism involved in the Rust code execution path.
The technical root cause lies in how the unified parser handles tokenization and structural parsing logic for Gemma4 models. When a specifically crafted input sequence is processed, it likely triggers an unhandled edge case or resource exhaustion condition within the Rust runtime environment of the parser module. Although Rust provides memory safety guarantees through its ownership model, logical errors such as infinite loops, stack overflows due to deep recursion without proper bounds checking, or improper handling of malformed token streams can still lead to application crashes. In this specific instance, the manipulation leads directly to a denial of service, indicating that the parser fails gracefully and instead terminates unexpectedly when encountering maliciously constructed data patterns designed to exploit parsing logic flaws.
From an operational perspective, because vLLM is often deployed as a remote inference API serving multiple clients simultaneously, a successful exploitation of this vulnerability can have severe consequences for availability. An attacker launching a remote attack does not necessarily need authentication if the service endpoint is exposed without strict access controls or rate limiting. The impact includes complete downtime for applications relying on the Gemma4 model hosted via vLLM, leading to service degradation and potential financial loss depending on the criticality of the downstream services. This aligns with ATT&CK technique T1499 Endpoint Denial of Service, where an adversary disrupts access to an asset by exhausting resources or crashing a process.
The exploit for this vulnerability has been publicly disclosed, which significantly increases the risk landscape as automated scanning tools and malicious actors can now easily reproduce the attack vector against unpatched instances. Immediate remediation is strongly advised by upgrading vLLM to version 0.29.1rc0 or later. The specific patch resolving this issue is identified by commit hash 3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9, which likely introduces stricter input validation and error handling within the Gemma4UnifiedParser logic. Until an upgrade can be performed, organizations should consider implementing network-level rate limiting or WAF rules to restrict access to the affected endpoints from untrusted sources, thereby mitigating the risk of remote exploitation while planning for a permanent software update.