Executive brief
vLLM is an open-source library that serves large language models and handles requests through HTTP endpoints. A vulnerability in the disaggregated serving endpoint allows an authenticated attacker to send requests with excessively long token sequences that bypass security checks, causing the service to crash and become unavailable. This denial of service affects deployments using certain multimodal models like Nemotron Parse, Whisper, and FireRedLID.
Technical details
The /inference/v1/generate disaggregated serving endpoint fails to validate decoder prompt length when processing multimodal requests with a 'features' payload. Specifically, for multimodal processors that set skip_prompt_length_check=True, the InputProcessor._validate_prompt_len() method returns early and skips both encoder and decoder prompt validation. An attacker with network access to the endpoint can submit an overlong token_ids list that bypasses this validation, reaches the worker input-batch copy, and triggers a NumPy broadcast failure during buffer allocation, crashing the worker process.
Affected products
- vLLM Project vLLM before 0.29.0
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in vLLM 0.29.0