Description

vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' (multimodal) payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal EngineInput directly from the caller-supplied token_ids, and GenerateRequest.token_ids (vllm/entrypoints/serve/disagg/protocol.py) is not checked against model_config.max_model_len. For multimodal processors that report skip_prompt_length_check=True (for example Nemotron Parse, Whisper, and FireRedLID), InputProcessor._validate_prompt_len() returns immediately for both encoder and decoder prompts, so an overlong prompt becomes an EngineCoreRequest and reaches the worker input-batch copy into a fixed max_model_len-wide NumPy row. A client able to reach the endpoint on an affected model configuration can therefore submit an overlong token_ids list to trigger a worker failure and denial of service. Fixed in 0.29.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-26T14:16:47.663Z",
  "pubdate": "2026-09-26T14:16:47.663Z",
  "executiveSummary": "A critical vulnerability exists in vLLM versions prior to 0.29.0, specifically within the disaggregated serving endpoint /inference/v1/generate. The flaw involves a failure to enforce prompt-length validation when processing multimodal 'features' payloads.\nThis vulnerability allows an attacker to bypass critical input constraints by submitting overlong token_ids sequences. Because the application fails to validate these inputs against the model_config.max_model_len, the system attempts to process malformed data, leading to a worker-level failure.\nThe primary impact is a Denial of Service (DoS) condition, as the worker crashes when attempting to copy the oversized input into a fixed-width buffer. Exploitation is possible for any client capable of reaching the /inference/v1/generate endpoint on an affected deployment. Given the nature of the failure, this could lead to significant operational disruption in resource-constrained or production environments.\nThe vulnerability is particularly pronounced in models where the multimodal processor signals skip_prompt_length_check=True, such as Nemotron Parse, Whisper, and FireRedLID, effectively disabling the input sanitization mechanism that should prevent buffer overflows or memory-related crashes.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper input validation logic within vllm/entrypoints/serve/disagg/serving.py. When a request is submitted to the /inference/v1/generate endpoint containing a 'features' multimodal payload, the serving layer constructs an EngineInput object directly from user-supplied token_ids without verifying these against the model's architectural constraints defined in model_config.max_model_len.\nIn the affected architecture, GenerateRequest.token_ids (defined in vllm/entrypoints/serve/disagg/protocol.py) bypasses the expected validation workflow. For multimodal processors that utilize the skip_prompt_length_check=True flag, the InputProcessor._validate_prompt_len() function performs an early return, skipping necessary safety checks for both encoder and decoder prompts.\nThe attack flow proceeds as follows: An attacker sends a specially crafted POST request to the /inference/v1/generate endpoint. The payload includes a token_ids array that exceeds the model's supported max_model_len. Because the input validation is bypassed, this oversized request is treated as a valid EngineCoreRequest. The request is then forwarded to the worker component, which attempts to copy the excessive data into a pre-allocated, fixed-size NumPy array constrained by max_model_len. The mismatch between the supplied input size and the allocated buffer size triggers a memory-related exception or runtime error during the copy operation, resulting in a worker process crash.\nThe vulnerability affects versions prior to 0.29.0. It requires network access to the vLLM serving endpoint but does not inherently require high-level authentication, as the request reaches the vulnerable logic before standard model-processing validation gates. The impact is a hard crash of the vLLM worker process, necessitating a restart and resulting in service unavailability. By repeatedly submitting such payloads, an attacker can continuously disrupt the model serving infrastructure, effectively maintaining a persistent DoS state against the affected vLLM deployment."
}