7.5

CVE-2026-103241: vllm-project vllm Improper Resource Shutdown or Release

CVSS: 7.5v3.1HighAnalyzed
AliasesPYSEC-2026-4186
Published 30-09-2026Last modified 02-10-2026
Open JSON

Vulnerability summary

CVE-2026-103241 is a high (CVSS 7.5) Improper Resource Shutdown or Release vulnerability in vllm-project vllm. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.8% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
40/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
0.71%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Timeline

  1. 30-09-2026
    PublishedVulnerability first disclosed.
  2. 02-10-2026
    Last modifiedVulnerability information updated.

Description

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 0.29.1rc0 is able to resolve this issue. This patch is called 3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9. Upgrading the affected component is advised.

CVSS metrics

8 scores · 3 sources · 4 versions

EPSS trend

Probability

0.71%

Chance of exploitation in the next 30 days

Percentile

53%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

01-10-202620-10-2026
EPSS score
0.71%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    8E98D656Aa667095B513161Eb056D28E

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

PyPI1 product
  • vllm< 0.27.0
Vllm1 product
Vllm-project1 product
  • vllm0.1 | 0.2 | 0.3 | 0.4 | 0.5 | 0.6 | 0.7 | 0.8 | 0.9 | 0.10 | 0.11 | 0.12 | 0.13 | 0.14 | 0.15 | 0.16 | 0.17 | 0.18 | 0.19 | 0.20 | 0.21 | 0.22 | 0.23 | 0.24 | 0.25 | 0.26.0

3 vendors · 3 products

References

10 links