CVE-2026-105759: CWE-400: Uncontrolled Resource Consumption in vllm-project vllm

The vulnerability arises because the track_http_metrics middleware in vllm versions before 0.30.0 records raw HTTP method tokens as Prometheus label values without validation or limitation. An attacker can send many unique HTTP method tokens to routes like /tokenize, triggering Prometheus's Family::get_or_create function to create permanent counter and histogram label sets for each unique token. This uncontrolled growth in label sets causes increased memory consumption and bloated /metrics responses, which can exhaust the service or monitoring infrastructure. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and has a CVSS 3.1 base score of 5.9 (medium severity). The issue is resolved in vllm version 0.30.0.

Exploitation of this vulnerability results in denial of service conditions due to resource exhaustion. Specifically, the process memory usage grows as Prometheus metric label sets accumulate without limit, and the /metrics endpoint response size increases, potentially exhausting service or monitoring resources. There is no impact on confidentiality or integrity, only availability is affected.

Upgrade to vllm version 0.30.0 or later, where this issue is fixed. Prior versions are vulnerable. No other mitigations or workarounds are indicated in the available data.