GHSA-6pgw-f3pv-4h8q: vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids
vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprobtokenids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with outputlogprobs enabled and more than 128 outputcandidates.tokenids, triggering a fatal sampler exception that crashes the engine.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/vllmto a version that resolves this vulnerability.Fixed in 0.24.0 - Upgrade
Upgrade
vLLMto a version that resolves this vulnerability.Fixed in 0.24.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using vLLM from 0.22.0 before 0.24.0 are affected when the Rust gRPC frontend can receive Generate or GenerateStream requests. The vulnerable package is pip/vllm.
What must an attacker send to crash the engine?
An attacker must send a Generate or GenerateStream gRPC request with output_logprobs enabled and more than 128 output_candidates.token_ids. This bypasses the relevant limit and triggers a fatal sampler exception that terminates EngineCore.
Is authentication or user interaction required for exploitation?
No. The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction.
What can be done if upgrading is not immediately possible?
The available information supports restricting access to the affected gRPC Generate and GenerateStream endpoints and preventing requests that enable output_logprobs with more than 128 output_candidates.token_ids. Upgrading to 0.24.0 or later removes the affected version range.