Executive brief
vLLM is an open-source engine used to serve Large Language Models (LLMs) for AI applications. A flaw in its speculative decoding feature allows a user to crash the entire server process by sending a single request containing specific parameters, such as a repetition penalty. This results in a complete denial of service, making the AI application unavailable to all users until the process is manually restarted.
Technical details
A denial-of-service vulnerability exists in vLLM's 'extract_hidden_states' speculative decoding proposer due to an incorrect tensor shape calculation. Following a refactor in version 0.18.0, the 'propose()' method fails to account for semantic changes in 'sampled_token_ids' after the first decode step, returning a tensor of shape (batch_size, 2) instead of the expected (batch_size, 1). When a request includes sampling penalty parameters (repetition, frequency, or presence penalties), this shape mismatch triggers a broadcast error and a RuntimeError, crashing the EngineCore process. The attack can be executed by any authenticated user capable of sending inference requests with custom sampling parameters. The issue is resolved in version 0.20.0 by ensuring the return value is correctly sliced.
Affected products
- vLLM Project vLLM >= 0.18.0, < 0.20.0
Timeline
- 2026-03-31: other: Fix pull request submitted
- 2026-04-09: patched: Fix merged into main branch
- 2026-04-28: advisory: Vendor advisory published via GitHub
- 2026-05-12: disclosed: CVE published to NVD