CVE-2026-103241 - Vulnerability Details

- vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service

Description

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 0.29.1rc0 is able to resolve this issue. This patch is called 3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9. Upgrading the affected component is advised.

Published: 2026-09-30

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

vllm-project

vLLM

affected

Version	Status	Constraints
`0.1`	affected	—
`0.2`	affected	—
`0.3`	affected	—
`0.4`	affected	—
`0.5`	affected	—
`0.6`	affected	—
`0.7`	affected	—
`0.8`	affected	—
`0.9`	affected	—
`0.10`	affected	—
`0.11`	affected	—
`0.12`	affected	—
`0.13`	affected	—
`0.14`	affected	—
`0.15`	affected	—
`0.16`	affected	—
`0.17`	affected	—
`0.18`	affected	—
`0.19`	affected	—
`0.20`	affected	—
`0.21`	affected	—
`0.22`	affected	—
`0.23`	affected	—
`0.24`	affected	—
`0.25`	affected	—
`0.26.0`	affected	—
`0.29.1rc0`	unaffected	—

No data.

Vendor Product Confidence Versions

Vllm-project

Vllm

95%

Version	Status	Scheme	Platform
`0.1`	affected	generic	—
`0.2`	affected	generic	—
`0.3`	affected	generic	—
`0.4`	affected	generic	—
`0.5`	affected	generic	—
`0.6`	affected	generic	—
`0.7`	affected	generic	—
`0.8`	affected	generic	—
`0.9`	affected	generic	—
`0.10`	affected	generic	—
`0.11`	affected	generic	—
`0.12`	affected	generic	—
`0.13`	affected	generic	—
`0.14`	affected	generic	—
`0.15`	affected	generic	—
`0.16`	affected	generic	—
`0.17`	affected	generic	—
`0.18`	affected	generic	—
`0.19`	affected	generic	—
`0.20`	affected	generic	—
`0.21`	affected	generic	—
`0.22`	affected	generic	—
`0.23`	affected	generic	—
`0.24`	affected	generic	—
`0.25`	affected	generic	—
`0.26.0`	affected	semver	—
`0.29.1rc0`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00657.

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://gist.github.com/Yunzez/8e98d656aa667095b513161eb056d28e
https://github.com/vllm-project/vllm/
https://github.com/vllm-project/vllm/commit/3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9
https://github.com/vllm-project/vllm/issues/50927
https://github.com/vllm-project/vllm/pull/54303
https://github.com/vllm-project/vllm/releases/tag/v0.29.1rc0
https://vuldb.com/cve/CVE-2026-103241
https://vuldb.com/submit/956250
https://vuldb.com/vuln/411965
https://vuldb.com/vuln/411965/cti

History

Fri, 02 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 30 Sep 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 0.29.1rc0 is able to resolve this issue. This patch is called 3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9. Upgrading the affected component is advised.
Title		vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service
First Time appeared		Vllm-project Vllm-project vllm
Weaknesses		CWE-404
CPEs		cpe:2.3:a:vllm-project:vllm::::::::
Vendors & Products		Vllm-project Vllm-project vllm
References		https://gist.github.com/Yunzez/8e98d656aa667095b513161eb056d28e https://github.com/vllm-project/vllm/ https://github.com/vllm-project/vllm/commit/3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9 https://github.com/vllm-project/vllm/issues/50927 https://github.com/vllm-project/vllm/pull/54303 https://github.com/vllm-project/vllm/releases/tag/v0.29.1rc0 https://vuldb.com/cve/CVE-2026-103241 https://vuldb.com/submit/956250 https://vuldb.com/vuln/411965 https://vuldb.com/vuln/411965/cti
Metrics		cvssV2_0 `{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Vllm-project Vllm

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-30T16:45:13.581Z

Updated: 2026-10-02T16:23:50.737Z

Reserved: 2026-09-30T10:36:13.164Z

Link: CVE-2026-103241

Vulnrichment

Updated: 2026-10-02T16:23:45.567Z

NVD

Status : Undergoing Analysis

Published: 2026-09-30T17:16:42.570

Modified: 2026-10-02T17:17:02.123

Link: CVE-2026-103241

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-01T15:30:08Z

Weaknesses

CWE-404
Improper Resource Shutdown or Release

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Exploitation poc

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object