CVE-2025-29770: vLLM denial of service via unbounded Outlines disk cache

Executive brief

vLLM is a high-performance engine used to run large language models. A vulnerability in its structured output component allows a user to fill up the server's storage space by sending many unique requests. This can lead to a complete system crash or service outage, preventing the AI from responding to legitimate users.

Technical details

vLLM (V0 engine) is vulnerable to resource exhaustion (CWE-770) via the Outlines library used for guided decoding. The Outlines backend unconditionally enables a local filesystem cache for compiled grammars without imposing size limits or rotation policies. An attacker with network access to the OpenAI-compatible API can send a stream of short requests with unique schemas, forcing the creation of new cache entries until the host's disk space is exhausted. This issue is fixed in version 0.8.0 by disabling the cache by default. The V1 engine is not affected.

Affected products

• vLLM Project vLLM < 0.8.0

Timeline

• 2025-03-19: advisory: GitHub Advisory GHSA-mgrm-fgjv-mhv8 published
• 2025-03-19: patched: vLLM version 0.8.0 released

References

• https://api.github.com/users/russellb
• https://github.com/russellb
• https://api.github.com/users/russellb/gists%7B/gist_id%7D
• https://api.github.com/users/russellb/repos
• https://avatars.githubusercontent.com/u/309258?v=4
• https://api.github.com/users/russellb/events%7B/privacy%7D