The vLLM server is vulnerable to a denial-of-service attack due to its failure to enforce an outer prompt-count limit. An attacker can make one request consume CPU, memory, async task scheduling, engine request slots, and response buffering proportional to the length of the outer prompt list. This can starve or disrupt other tenants sharing the same vLLM server. The report does not claim unauthenticated access, confidentiality impact, integrity impact, code execution, or impact where is not reachable by untrusted or semi-trusted clients. The intended fix involves rejecting oversized prompt lists before renderer preprocessing and adding an outer prompt-count limit to CompletionRequest.prompt when the prompt is list[str] or list[list[int]]. The check should run before OnlineRenderer.preprocess_completion expands the prompt sequence, so oversized requests do not allocate parsed prompt lists, async render/tokenization tasks, engine generators, or response result slots. The affected package ecosystem is pip, and the affected range confirmed by source proof is >=0.19.0, <=0.24.0.
We recommend you to update vllm to version 0.26.0.[/subscribe_to_unlock_form]
The vLLM server is vulnerable to a denial-of-service attack due to its failure to enforce an outer prompt-count limit. An attacker can make one request consume CPU, memory, async task scheduling, engine request slots, and response buffering proportional to the length of the outer prompt list. This can starve or disrupt other tenants sharing the same vLLM server. The report does not claim unauthenticated access, confidentiality impact, integrity impact, code execution, or impact where is not reachable by untrusted or semi-trusted clients. The intended fix involves rejecting oversized prompt lists before renderer preprocessing and adding an outer prompt-count limit to CompletionRequest.prompt when the prompt is list[str] or list[list[int]]. The check should run before OnlineRenderer.preprocess_completion expands the prompt sequence, so oversized requests do not allocate parsed prompt lists, async render/tokenization tasks, engine generators, or response result slots. The affected package ecosystem is pip, and the affected range confirmed by source proof is >=0.19.0, <=0.24.0.
We recommend you to update vllm to version 0.26.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]