Description

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel OOM-kill of the decode worker process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-21T22:17:01.587Z",
  "pubdate": "2026-09-21T22:17:01.587Z",
  "executiveSummary": "vLLM versions up to and including 0.29.0 are susceptible to a memory exhaustion vulnerability stemming from insufficient input validation on OpenAI-compatible completion endpoints. Specifically, the 'tp_size' parameter within 'kv_transfer_params' is not properly sanitized, allowing an attacker to supply arbitrary, out-of-bounds values. By manipulating this parameter in prefill/decode disaggregated deployment architectures, an attacker can force the system to attempt unbounded memory allocation. This operation consumes host resources indiscriminately, inevitably triggering an OOM (Out-Of-Memory) event within the kernel. Consequently, the decode worker process is forcibly terminated, leading to a critical Denial of Service (DoS) for the affected infrastructure. This vulnerability poses significant operational risk to high-throughput inference environments where disaggregated KV caching is enabled. Exploitation does not require elevated privileges and can be executed by any actor capable of interacting with the inference endpoint, representing a high-impact threat to service availability.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper validation of the 'tp_size' parameter within the 'kv_transfer_params' structure in the vLLM request handling logic. In distributed inference setups using disaggregated prefill and decode roles, the vLLM framework relies on these parameters to coordinate KV cache transfers between worker instances. The code fails to enforce a maximum bound or verify the sanity of the 'tp_size' value provided via the API request before using it to allocate memory buffers or configure internal data structures.\nWhen an attacker sends a crafted request to an OpenAI-compatible completion endpoint, they can inject an excessively large integer value into the 'tp_size' field. Upon receiving this input, the vulnerable component processes the request and attempts to instantiate tensors or buffers proportional to the specified 'tp_size'. Because the allocation logic lacks constraints, the request triggers a massive memory reservation attempt on the host machine hosting the decode worker process.\nThe attack flow follows a direct vector: the attacker submits a standard inference request with an appended 'kv_transfer_params' object containing a malicious 'tp_size' configuration. The vLLM worker, lacking internal bounds checking, treats this value as a legitimate operational parameter. The system attempts to reserve the requested memory size, which typically exceeds the physical RAM or available swap capacity of the container or host. As the kernel identifies a critical memory pressure condition, the OOM Killer is invoked to stabilize the system, resulting in the immediate and ungraceful termination of the decode worker process. This effectively crashes the inference pipeline for the specific worker node.\nThe vulnerability is present in versions of vLLM up to 0.29.0. It primarily affects deployments utilizing disaggregated KV caching, as these environments are designed to parse and utilize the 'kv_transfer_params' input. There is no requirement for authentication to trigger this behavior if the endpoint is exposed, and the exploit requires no specialized privileges, making it a highly accessible denial-of-service vector for any externally reachable vLLM instance."
}