CVE-2026-34756 is a resource exhaustion vulnerability (CWE-770) in the vllm-project's vllm inference engine for large language models. Specifically, the OpenAI-compatible API server does not enforce an upper bound on the 'n' parameter in ChatCompletionRequest and CompletionRequest Pydantic models. An attacker can exploit this by sending a single HTTP request with an astronomically large 'n' value, causing the server to allocate millions of request object copies in memory before scheduling, which blocks the asyncio event loop and results in an immediate Out-Of-Memory crash. This affects all vllm versions from 0.1.0 up to but not including 0.19.0. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity).

Successful exploitation results in a Denial of Service condition by exhausting server memory and blocking the event loop, causing the vllm service to crash. There is no impact on confidentiality or integrity reported. The vulnerability can be triggered by an unauthenticated attacker via a single HTTP request.

This vulnerability is fixed in vllm version 0.19.0. Users should upgrade to version 0.19.0 or later to remediate this issue. Patch status is not explicitly stated in the vendor advisory, but the fix is included in the specified version. Until upgraded, users should consider implementing request size limits or input validation on the 'n' parameter at a proxy or API gateway level to mitigate exploitation.