CVE-2026-100651: vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass
vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' (multimodal) payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal EngineInput directly from the caller-supplied tokenids, and GenerateRequest.tokenids (vllm/entrypoints/serve/disagg/protocol.py) is not checked against modelconfig.maxmodellen. For multimodal processors that report skippromptlengthcheck=True (for example Nemotron Parse, Whisper, and FireRedLID), InputProcessor.validatepromptlen() returns immediately for both encoder and decoder prompts, so an overlong prompt becomes an EngineCoreRequest and reaches the worker input-batch copy into a fixed maxmodellen-wide NumPy row. A client able to reach the endpoint on an affected model configuration can therefore submit an overlong tokenids list to trigger a worker failure and denial of service. Fixed in 0.29.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vLLMto a version that resolves this vulnerability.Fixed in 0.29.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Affected deployments are vLLM versions before 0.29.0 that expose the disaggregated serving endpoint /inference/v1/generate and use a multimodal processor reporting skip_prompt_length_check=True. Examples named in the advisory are Nemotron Parse, Whisper, and FireRedLID.
What access does an attacker need?
An attacker needs the ability to send requests to /inference/v1/generate on an affected model configuration. They can trigger the issue by supplying a features multimodal payload and an overlong token_ids list; no user interaction is required.
How can I determine whether a deployment is affected?
Check whether the deployed vLLM version is earlier than 0.29.0, whether the disaggregated generate endpoint is reachable by untrusted or low-privileged clients, and whether the configured multimodal processor skips prompt-length checks. Affected requests can cause a worker failure when oversized token_ids reach copying into a fixed max_model_len-wide input row.
What should be done if patching cannot happen immediately?
Restrict access to /inference/v1/generate to trusted clients and prevent callers from submitting oversized token_ids, particularly in requests containing a features payload. Upgrading to vLLM 0.29.0 fixes the issue.