Description

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kv_transfer_params dictionary entries to trigger an uncaught KeyError in EngineCore scheduling, causing the decode engine to terminate and making all routed requests fail until manual restart.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-21T22:17:00.960Z",
  "pubdate": "2026-09-21T22:17:00.960Z",
  "executiveSummary": "vLLM versions through 0.29.0 are susceptible to a Denial of Service (DoS) vulnerability originating from the NIXL connector's metadata processing logic.\nThe vulnerability is characterized as an uncaught KeyError exception occurring within the EngineCore scheduling component during the handling of disaggregated prefill/decode requests.\nAn unauthenticated attacker can exploit this flaw by submitting crafted requests containing incomplete 'kv_transfer_params' dictionary entries.\nSuccessful exploitation triggers an unhandled exception that causes the decode engine to terminate prematurely, resulting in a total service disruption for all routed requests.\nThis impact necessitates manual intervention to restore service availability, as the engine does not automatically recover from the crash.\nThe vulnerability represents a significant risk to high-availability infrastructure utilizing disaggregated deployment architectures, as it allows for trivial service interruption without the need for elevated privileges or complex authentication.\nSecurity teams should prioritize restricting access to the API endpoints involved in request handling and monitoring for anomalous payload structures until patches or configuration hardening are applied.",
  "technicalDetails": "The vulnerability exists within the NIXL connector, a component responsible for facilitating metadata exchange between prefill and decode engines in disaggregated vLLM deployments.\nThe root cause is a failure in the EngineCore scheduling logic to validate the presence of expected keys within the 'kv_transfer_params' dictionary before accessing them.\nDuring the processing of a request, the NIXL connector extracts metadata from the incoming packet. If an attacker sends a request where 'kv_transfer_params' is malformed or missing specific required keys, the downstream code attempts to perform a dictionary look-up for those keys without a 'try-except' block or input sanitization.\nThe resulting KeyError is not caught within the context of the EngineCore scheduler loop. Because this error occurs within the critical path of engine request orchestration, it propagates to the top-level execution thread of the decode engine process.\nThe unhandled exception causes the process to exit immediately. Since the decode engine is responsible for the actual generation tokens and KV cache management, its termination causes all current and future routed requests to fail, effectively silencing the service.\nAttack flow: 1. The attacker identifies the API endpoint facilitating disaggregated request routing. 2. The attacker constructs a request payload that includes a 'kv_transfer_params' field configured with incomplete or missing parameters. 3. The vLLM NIXL connector receives the request and passes the dictionary to the EngineCore scheduling function. 4. The scheduler attempts to access a mandatory key within 'kv_transfer_params' that the attacker omitted. 5. A KeyError is raised, causing the Python process managing the decode engine to terminate. 6. Service availability is lost until an administrator manually restarts the vLLM instance.\nThis flaw is exploitable over the network without authentication, provided the attacker has access to the entry point for request routing. There are no specific privilege requirements for the attack to succeed beyond the ability to reach the API endpoint."
}