Description

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in NixlBaseConnectorWorker._apply_prefix_caching by submitting completion requests with multiple prompts of varying lengths, causing the decode worker to terminate and become unavailable until restarted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-21T22:17:01.123Z",
  "pubdate": "2026-09-21T22:17:01.123Z",
  "executiveSummary": "A denial of service (DoS) vulnerability exists in vLLM through version 0.29.0 within the NIXL connector's prefix caching mechanism. The issue stems from insufficient validation of block counts during the processing of multi-prompt completion requests in disaggregated prefill and decode environments. An attacker can exploit this flaw by submitting specifically crafted completion requests featuring varying prompt lengths, which triggers an assertion failure within the NixlBaseConnectorWorker._apply_prefix_caching function. This failure forces the termination of the affected decode worker process, rendering it unavailable until manual intervention or a service restart is performed. The vulnerability poses a significant risk to the availability of inference services utilizing disaggregated deployments. Exploitation does not appear to require elevated privileges, as it targets the request-handling logic of the inference engine. By disrupting the decode worker's state consistency, unauthorized users can cause cascading service degradation and complete outages of the inference pipeline, directly impacting production-grade LLM serving infrastructure.",
  "technicalDetails": "The vulnerability is localized within the NixlBaseConnectorWorker._apply_prefix_caching function, which is responsible for managing block memory allocation during the prefix caching phase of request processing. In vLLM architectures utilizing disaggregated prefill and decode roles, the consistency of the KV cache metadata between these distinct worker types is critical. The flaw arises because the implementation fails to perform robust boundary and validity checks on block counts when handling requests that include multiple prompts with heterogeneous lengths.\nWhen a user submits a batch request, the NixlBaseConnectorWorker attempts to correlate the prefix cache blocks with the incoming prompt metadata. If the lengths of the prompts vary significantly, the internal state management within _apply_prefix_caching calculates an invalid block count or memory offset. This discrepancy causes an internal assertion to fail, as the code encounters an unexpected state that contradicts the initialized memory map for the decode worker. Because this check is performed at the architectural level of the connector, the resulting assertion failure is unhandled, leading to an immediate process abort of the worker thread or process.\nThe attack flow follows a predictable sequence: First, the attacker identifies an inference endpoint configured for disaggregated deployment using the NIXL connector. Second, the attacker constructs a multipart completion request or a batch request containing prompts of deliberately mismatched or anomalous lengths. Third, upon receipt, the decode worker attempts to reconcile the prefix cache state for these prompts. The function _apply_prefix_caching identifies the inconsistent block count, triggering the assertion failure. Finally, the decode worker process crashes, removing itself from the available resource pool. In a production environment with auto-scaling or fixed-worker pools, an attacker can repeat this process to exhaust available worker nodes, resulting in a total denial of service for all users.\nThis vulnerability is particularly impactful because it targets the underlying coordination logic between the prefill and decode components, rather than a specific model weights issue or a standard API input validation failure. As such, the input payload bypasses standard high-level request filtering and triggers the crash at the system integration level, specifically affecting versions up to and including 0.29.0."
}