Description

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generate_responses, choices, token_ids, prompt_logprobs, logprobs.content, top_logprobs, and routed_experts structures are processed by OnlineDerenderer and tokenizer.decode before max_model_len, max_tokens, max_num_seqs, or response-size limits are enforced, allowing an authenticated API client to consume excessive CPU and memory and produce oversized responses. This issue is fixed in version 0.26.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T20:16:45.927Z",
  "pubdate": "2026-08-17T20:16:45.927Z",
  "executiveSummary": "An improper resource management vulnerability exists in vLLM prior to version 0.26.0 within the /v1/completions/derender and /v1/chat/completions/derender endpoints.\nThe vulnerability allows an authenticated API client to supply crafted GenerateResponse objects containing oversized structures such as generate_responses, choices, token_ids, prompt_logprobs, logprobs.content, top_logprobs, and routed_experts.\nThese structures are processed by OnlineDerenderer and tokenizer.decode before any validation checks for max_model_len, max_tokens, max_num_seqs, or general response-size limits are enforced.\nSuccessful exploitation leads to excessive CPU and memory consumption, resulting in denial of service conditions and the generation of oversized responses.\nThe attack requires authentication as an API client with access to the affected derender endpoints, making proper access control and input validation critical mitigation prerequisites.",
  "technicalDetails": "The vulnerability resides in the request handling logic of the /v1/completions/derender and /v1/chat/completions/derender endpoints exposed by vLLM prior to version 0.26.0.\nThe root cause stems from a lack of early-stage input validation and constraint enforcement regarding the size and dimensions of caller-supplied GenerateResponse objects.\nWhen an authenticated API client submits a specially crafted payload to the vulnerable endpoints, the application passes the nested data structures—specifically generate_responses, choices, token_ids, prompt_logprobs, logprobs.content, top_logprobs, and routed_experts—directly into the OnlineDerenderer component and subsequently to tokenizer.decode.\nThis processing occurs entirely prior to the evaluation of standard operational thresholds such as max_model_len, max_tokens, max_num_seqs, or generic response-size limitations.\nThe attack flow proceeds as follows: First, the authenticated attacker constructs a malicious HTTP POST request targeting either the /v1/completions/derender or /v1/chat/completions/derender endpoint. Second, the request payload contains massive or deeply nested array structures within the designated fields of the GenerateResponse object. Third, the vLLM server accepts the request and immediately invokes OnlineDerenderer and tokenizer.decode to parse the oversized token arrays and metadata without prior boundary checks. Fourth, the decoding routines consume vast amounts of CPU cycles and heap memory in an attempt to process the inflated token lists and log probability contents. Finally, this uncontrolled resource allocation exhausts system resources, leading to service degradation, application crashes, or severe memory exhaustion affecting concurrent operations.\nThe affected components comprise the OnlineDerenderer class, the tokenizer.decode integration, and the associated routing logic for the /v1/completions/derender and /v1/chat/completions/derender routes across all vLLM versions prior to 0.26.0.\nExploitation requires network exposure of the vLLM inference server, valid authentication credentials to access the API endpoints, and the ability to submit arbitrary JSON payloads containing malicious GenerateResponse structures."
}