Executive brief
vLLM is a high-performance engine used for serving large language models. A performance flaw in how the system processes specific input tags (like those for images or audio) allows an attacker to send specially crafted requests that overwhelm the server's processor. This can lead to a total service outage, preventing legitimate users from accessing the AI models.
Technical details
A denial-of-service vulnerability exists in vLLM's 'input_processor_for_phi4mm' function due to inefficient list concatenation. The multimodal tokenizer replaces placeholder tokens (e.g., audio or image tags) using an in-place modification pattern (input_ids[:i] + tokens + input_ids[i+1:]) that copies the entire list for every replacement. This results in O(n²) quadratic time complexity. A remote attacker with low privileges can provide a crafted input with a high number of placeholders to trigger resource exhaustion. The issue is addressed in version 0.8.5 by moving to a single-pass preallocated array approach.
Affected products
- vLLM Project vLLM >= 0.8.0, < 0.8.5
Timeline
- 2025-04-29: advisory: GHSA-vc6m-hm49-g9qg published
- 2025-04-29: patched: Version 0.8.5 released