Description

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded list[str] or list[list[int]], prompt_to_seq() in vllm/renderers/inputs/preprocess.py and OnlineRenderer.preprocess_completion() in vllm/renderers/online_renderer.py expand every element, and vllm/entrypoints/openai/completion/serving.py creates one engine generator and response slot per prompt, allowing an authenticated API client to exhaust CPU, memory, async scheduling capacity, engine request slots, and response buffering with one request. This issue is fixed in version 0.26.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T16:19:05.863Z",
  "pubdate": "2026-08-13T16:19:05.863Z",
  "executiveSummary": "A Denial of Service vulnerability exists in the vLLM inference and serving engine, specifically affecting the OpenAI-compatible completions endpoint. The flaw stems from insufficient input validation and unbounded resource allocation when processing the prompt field.\nAn authenticated API client can exploit this vulnerability by submitting a maliciously crafted request containing an unbounded list of strings or token lists. This forces the application to disproportionately expand, allocate, and buffer resources across internal rendering and engine generator pipelines.\nThe successful exploitation of this vulnerability leads to severe resource exhaustion, impacting CPU utilization, system memory, asynchronous scheduling capacity, engine request slots, and response buffering. This causes immediate degradation or complete disruption of the serving engine's availability.\nThe affected product is vLLM, specifically versions ranging from 0.19.0 up to, but not including, 0.26.0. Mitigation requires upgrading the vLLM package to version 0.26.0 or later, where proper input bounds are enforced.",
  "technicalDetails": "The vulnerability resides in the OpenAI completions API implementation of the vLLM inference engine. Specifically, the vulnerable components include the /v1/completions endpoint handling the CompletionRequest.prompt field within vllm/entrypoints/openai/completion/protocol.py, the prompt_to_seq() function located in vllm/renderers/inputs/preprocess.py, the OnlineRenderer.preprocess_completion() method in vllm/renderers/online_renderer.py, and the serving logic in vllm/entrypoints/openai/completion/serving.py.\nThe root cause of the vulnerability is the lack of strict upper-bound validation on the size and multiplicity of the prompt parameter. In the affected versions (0.19.0 to 0.26.0), the prompt field accepts an unbounded list[str] or list[list[int]]. When a request is received, the preprocessing logic expands every individual element provided within the list structure.\nThe step-by-step attack flow proceeds as follows: First, an authenticated API client crafts an HTTP POST request to the /v1/completions endpoint containing a massive, unbounded array of strings or token lists in the prompt payload. Second, the vLLM endpoint receives the payload via protocol.py and passes it to the preprocessing pipeline. Third, prompt_to_seq() and OnlineRenderer.preprocess_completion() iterate over and expand every single element in the unbounded list without restriction. Fourth, vllm/entrypoints/openai/completion/serving.py instantiates a dedicated engine generator and a response slot for every individual expanded prompt.\nThis cascading expansion forces the underlying host and inference engine to exhaust system resources concurrently. The attack payload triggers intensive CPU consumption during parsing and expansion, rapid memory exhaustion via data structure allocation, saturation of asynchronous task scheduling queues, depletion of available engine request slots, and extensive response buffer bloat.\nExploitation requires network exposure of the OpenAI-compatible API endpoint and valid API authentication credentials, as the request must reach the serving API. No elevated privileges beyond standard client authentication are required to trigger the resource exhaustion condition."
}