CVE-2026-103241

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-103241
A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 0.29.1rc0 is able to resolve this issue. This patch is called 3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9. Upgrading the affected component is advised.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://gist.github.com/Yunzez/8e98d656aa667095b513161eb056d28e Product
https://github.com/vllm-project/vllm/ Product
https://github.com/vllm-project/vllm/commit/3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9 Patch
https://github.com/vllm-project/vllm/issues/50927 Issue Tracking Patch
https://github.com/vllm-project/vllm/pull/54303 Issue Tracking Patch
https://github.com/vllm-project/vllm/releases/tag/v0.29.1rc0 Release Notes
https://vuldb.com/cve/CVE-2026-103241 Third Party Advisory VDB Entry
https://vuldb.com/submit/956250 Third Party Advisory VDB Entry
https://vuldb.com/vuln/411965 Third Party Advisory VDB Entry
https://vuldb.com/vuln/411965/cti Permissions Required VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*
History

06 Oct 2026, 17:14

Type Values Removed Values Added
CPE cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*
References () https://gist.github.com/Yunzez/8e98d656aa667095b513161eb056d28e - () https://gist.github.com/Yunzez/8e98d656aa667095b513161eb056d28e - Product
References () https://github.com/vllm-project/vllm/ - () https://github.com/vllm-project/vllm/ - Product
References () https://github.com/vllm-project/vllm/commit/3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9 - () https://github.com/vllm-project/vllm/commit/3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9 - Patch
References () https://github.com/vllm-project/vllm/issues/50927 - () https://github.com/vllm-project/vllm/issues/50927 - Issue Tracking, Patch
References () https://github.com/vllm-project/vllm/pull/54303 - () https://github.com/vllm-project/vllm/pull/54303 - Issue Tracking, Patch
References () https://github.com/vllm-project/vllm/releases/tag/v0.29.1rc0 - () https://github.com/vllm-project/vllm/releases/tag/v0.29.1rc0 - Release Notes
References () https://vuldb.com/cve/CVE-2026-103241 - () https://vuldb.com/cve/CVE-2026-103241 - Third Party Advisory, VDB Entry
References () https://vuldb.com/submit/956250 - () https://vuldb.com/submit/956250 - Third Party Advisory, VDB Entry
References () https://vuldb.com/vuln/411965 - () https://vuldb.com/vuln/411965 - Third Party Advisory, VDB Entry
References () https://vuldb.com/vuln/411965/cti - () https://vuldb.com/vuln/411965/cti - Permissions Required, VDB Entry
First Time Vllm vllm
Vllm

30 Sep 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-09-30 17:16

Updated : 2026-10-06 17:14

NVD link : CVE-2026-103241

Mitre link : CVE-2026-103241

CVE.ORG link : CVE-2026-103241

JSON object : View

Products Affected

vllm

  • vllm
CWE
CWE-404

Improper Resource Shutdown or Release