CVE-2026-105754 | vllm-project vLLM up to 0.29.x EngineCore /inference/v1/generate input validation

SecurityVulns
Yanac

A vulnerability labeled as problematic has been found in vllm-project vLLM up to 0.29.x. This affects an unknown function of the file /inference/v1/generate of the component EngineCore. The manipulation of the argument features.kwargs_data/features.mm_hashes/features.mm_placeholders results in improper input validation.

This vulnerability is known as CVE-2026-105754. It is possible to launch the attack remotely. No exploit is available.

The affected component should be upgraded.VulDB Recent EntriesRead More