CVE-2026-103241: vllm through 0.26.0 (inclusive); +1 more affected products

Affected technology

vllm · through 0.26.0 (inclusive)
vllm

vLLM · 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 0.10, 0.11, 0.12, 0.13, 0.14, 0.15, 0.16, 0.17, 0.18, 0.19, 0.20, 0.21, 0.22, 0.23, 0.24, 0.25, 0.26.0
vllm-project

Description’s affected range: up to 0.26.0

Component: Gemma4UnifiedParser
File: rust/src/parser/src/unified/gemma4.rs

Attack conditions (VulDB, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could disrupt service. VulDB’s CVSS 4.0 assessment (base score 5.5/10) rates confidentiality and integrity impact as none; availability impact as low.