vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-105757 · Microsoft / collected KEV context

cve-program · CVE-2026-105757

• https://github.com/vllm-project/vllm/security/advisories/GHSA-85xf-c7hm-whqw
• https://github.com/vllm-project/vllm/pull/51450
• https://github.com/vllm-project/vllm/commit/c55e15a44ec4127832d4a86928a356fdd9e68dbd
• https://github.com/vllm-project/vllm/releases/tag/v0.30.0

No related operational record is retained in the current change model.