GHSA-34qw-q2h2-jp3m: vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders

Q: Which deployments are exposed to this denial-of-service issue?

vLLM versions from 0.20.0 up to, but not including, 0.30.0 are affected when the disaggregated /inference/v1/generate endpoint processes multimodal metadata. The issue is remotely reachable over the network and requires no privileges or user interaction.

Q: What does an attacker need to send to trigger the crash?

An attacker can replay a valid multimodal item while supplying inconsistent metadata, such as repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists. This can create a negative text span during Qwen2.5-VL position construction and terminate the engine.

Q: What is the impact of successful exploitation?

Successful exploitation crashes the vLLM engine, causing denial of service. The provided data indicates no confidentiality or integrity impact.

Published Oct 25, 2026

Updated

vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimodal item with repeated or overlapping mmplaceholders ranges or mismatched kwargsdata and mmhashes lists, producing a negative text span in Qwen2.5-VL position construction that terminates the engine.

Affected Software

1 affected componentFixes available

pip/vllm>=0.20.0<0.30.0

0.30.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/vllm to a version that resolves this vulnerability.
Fixed in 0.30.0

Event History

Oct 25, 2026

CVE Published

via OSV·01:20 PM

Data Sourced

via OSV·01:20 PM

DescriptionSeverityWeakness

Advisory Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

Affected Software

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

vLLM versions from 0.20.0 up to, but not including, 0.30.0 are affected when the disaggregated /inference/v1/generate endpoint processes multimodal metadata. The issue is remotely reachable over the network and requires no privileges or user interaction.

What does an attacker need to send to trigger the crash?

An attacker can replay a valid multimodal item while supplying inconsistent metadata, such as repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists. This can create a negative text span during Qwen2.5-VL position construction and terminate the engine.

What is the impact of successful exploitation?

Successful exploitation crashes the vLLM engine, causing denial of service. The provided data indicates no confidentiality or integrity impact.

GHSA-34qw-q2h2-jp3m: vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to send to trigger the crash?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to send to trigger the crash?

What is the impact of successful exploitation?