GHSA-8737-qx52-hjff: Medium severity pip/vllm vulnerability

Summary

The /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects and postprocess every nested choices[].tokenids list directly. Unlike the normal render/generate path, derender does not enforce model context length, resolved maxtokens, maxnumseqs, choice-count, or response-size bounds before detokenizing and returning the supplied token IDs. An authenticated API client can therefore make the CPU-only render frontend, or any server exposing these /v1 derender routes, spend CPU and memory proportional to attacker-chosen generated-output-shaped JSON rather than to a bounded generation result.

Technical Details

The render router registers /v1/chat/completions/derender and /v1/completions/derender in vllm/entrypoints/serve/render/apirouter.py, and the OpenAI API server attaches this router whenever "generate" or "render" is in supportedtasks (vllm/entrypoints/openai/apiserver.py). The routes are under /v1, so they are part of the OpenAI-compatible HTTP API surface and are protected by the API-key middleware when --api-key is configured.

The request types trust generated-output-shaped data from the client. In vllm/entrypoints/serve/disagg/protocol.py, GenerateResponseChoice accepts tokenids: list[int] | None = None, GenerateResponse accepts choices: list[GenerateResponseChoice], and DerenderCompletionRequest accepts generateresponses: list[GenerateResponse]. These fields have no max length, max item count, or relationship to a prior GenerateRequest.

The sink is OnlineDerenderer. derendercompletion() iterates every supplied generateresponses entry and every nested choice, calls tokenizer.decode(choice.tokenids, skipspecialtokens=True), appends the decoded text to the response choices, and increments totalcompletiontokens from the same supplied list length. derenderchat() has the same shape for a single supplied generateresponse, and can also feed the decoded text into tool/reasoning parsers when a parser and chatrequest are present. ServingRender.derendercompletionresponse() calls onlinederenderer.derendercompletion(request.generateresponses, request.prompttokens) before applying any completion-level validation beyond the model check.

Normal render and generation paths derive output limits from maxmodellen, the rendered prompt length, request maxtokens / maxcompletiontokens, and scheduler limits. Derender bypasses that invariant because it accepts the already-generated output shape directly from the HTTP caller. The missing invariant is: derender should only postprocess bounded generated output, and client-supplied derender payloads must be rejected if their nested generated token/logprob structures exceed the same limits that generation would have enforced.

PoV

The following bounded PoV can be run from a current vLLM checkout containing PR #43606. It asserts the current source facts for the derender routes, unchecked request fields, and decode sink, then simulates the same derender loop with a counting tokenizer. The negative control is a one-choice, 32-token response. The amplified payload keeps the test bounded but demonstrates that all decoded work and returned text scale directly with caller-supplied GenerateResponse contents.

python #!/usr/bin/env python3 import subprocess from dataclasses import dataclass from pathlib import Path

SOURCE = Path(".")

def requiresourcefact(path: str, needles: list[str]) -> None: text = (SOURCE / path).readtext() missing = [needle for needle in needles if needle not in text] if missing: raise AssertionError(f"{path} missing expected facts: {missing}")

def sourcehead() -> str: return subprocess.checkoutput(["git", "rev-parse", "HEAD"], cwd=SOURCE, text=True).strip()

@dataclass class Choice: index: int tokenids: list[int]

@dataclass class GenerateResponse: requestid: str choices: list[Choice]

class CountingTokenizer: def init(self) -> None: self.decodecalls = 0 self.decodedids = 0 def decode(self, tokenids: list[int], , skipspecialtokens: bool = True) -> str: self.decodecalls += 1 self.decodedids += len(tokenids) return "x" len(tokenids)

def derendercompletionlikecurrenthead(generateresponses: list[GenerateResponse], tokenizer: CountingTokenizer) -> tuple[int, int, int]: outputchars = 0 choices = 0 totalcompletiontokens = 0 for gen in generateresponses: for choice in gen.choices: if not choice.tokenids: raise ValueError("choice has empty or null tokenids") decodedtext = tokenizer.decode(choice.tokenids, skipspecialtokens=True) outputchars += len(decodedtext) totalcompletiontokens += len(choice.tokenids) choices += 1 return choices, totalcompletiontokens, outputchars

def makepayload(responses: int, choicesperresponse: int, tokensperchoice: int) -> list[GenerateResponse]: tokenids = [42] tokensperchoice return [GenerateResponse(requestid=f"gen-{r}", choices=[Choice(index=c, tokenids=list(tokenids)) for c in range(choicesperresponse)]) for r in range(responses)]

def runcase(name: str, payload: list[GenerateResponse]) -> None: tokenizer = CountingTokenizer() choices, completiontokens, outputchars = derendercompletionlikecurrenthead(payload, tokenizer) print(f"{name}: responses={len(payload)} choices={choices} decodecalls={tokenizer.decodecalls} decodedtokenids={tokenizer.decodedids} completiontokens={completiontokens} outputchars={outputchars}")

requiresourcefact("vllm/entrypoints/serve/render/apirouter.py", ['"/v1/completions/derender"', '"/v1/chat/completions/derender"', "app.includerouter(router)"]) requiresourcefact("vllm/entrypoints/serve/disagg/protocol.py", ["class GenerateResponseChoice(BaseModel):", "tokenids: list[int] | None = None", "class GenerateResponse(BaseModel):", "choices: list[GenerateResponseChoice]", "class DerenderCompletionRequest(BaseModel):", "generateresponses: list[GenerateResponse]"]) requiresourcefact("vllm/renderers/onlinederenderer.py", ["async def derendercompletion(", "for gen, pt in zip(generateresponses, prompttokenslist):", "for choice in gen.choices:", "decodedtext = tokenizer.decode(", "totalcompletiontokens += len(choice.tokenids)"]) print("sourcechecks=ok") print(f"sourcehead={sourcehead()}") runcase("negativecontrol", makepayload(responses=1, choicesperresponse=1, tokensperchoice=32)) runcase("amplifiedpayload", makepayload(responses=16, choicesperresponse=4, tokensperchoice=8192)) print("observation=derender decodes every caller-supplied token id before any maxmodellen, maxtokens, maxnumseqs, or response-size check")

Impact

An attacker with access to the /v1 API can send derender requests that consume CPU and memory in the frontend/postprocessing process and can cause large responses unrelated to any bounded generation. In disaggregated deployments, this affects the CPU-only render frontend; in servers where the render router is attached alongside generation, it affects the same OpenAI-compatible server process that handles normal client traffic. This can degrade availability for other clients sharing the process.

Likely CWE: CWE-400 (Uncontrolled Resource Consumption) / CWE-770 (Allocation of Resources Without Limits or Throttling). Conservative CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L (4.3). This is not Low severity because a regular network API client can induce availability impact in a shared service without local access, invalid model artifacts, or special runtime privileges. If the server is deployed without API-key enforcement for /v1, the privileges component becomes PR:N.

Suggested Fix

Validate derender payloads before any detokenization or parser invocation. Apply bounded limits to generateresponse(s), choices, tokenids, promptlogprobs, logprobs.content, toplogprobs, and routedexperts that are at least as strict as the corresponding generation-side limits. For completions, reject generateresponses counts above the number of prompts that /v1/completions/render would have produced, and reject total nested choice counts above maxnumseqs / n limits. For each choice, reject tokenids longer than the resolved output-token budget, or require derender callers to submit the original bounded GenerateRequest / sampling metadata and validate the GenerateResponse against it before decoding.

Add regression tests for both derender endpoints. The tests should show that a normal bounded derender payload succeeds, while oversized generateresponses, oversized choices, oversized tokenids, and oversized logprob/top-logprob structures are rejected before tokenizer.decode() or parser execution.

Affected Package/Versions

Confirmed affected: current main at ddd3855a28a561a5bb54d380c6e6b8b1e883cc4a and downstream/nightly builds that include the derender endpoints introduced by PR #43606. The derender router, request models, decode sink, render serving bridge, and OpenAI API router attachment have no relevant diff from 00e045b7c7b82599f626779e111233abd4d0a64e to ddd3855a28a561a5bb54d380c6e6b8b1e883cc4a.

Latest release checked: v0.23.0, published on 2026-06-15. Its vllm/entrypoints/serve/render/apirouter.py does not expose /v1/completions/derender or /v1/chat/completions/derender, so v0.23.0 was not confirmed affected.

Advisory History

PR #43606 ("[Render] Add /derender endpoints for disaggregated postprocessing") introduced the derender endpoints on main. PR #44285 later refactored the render serving code, and current head still contains the unchecked derender flow.

Public issue search for derender GenerateResponse tokenids returned no reports. Public search for "/v1/completions/derender" returned the derender feature RFC #42729 and unrelated bugs, but no size-bound, DoS, or generated-output postprocessing issue.

Related public request-fanout and resource-bound advisories are distinct:

- GHSA-3mwp-wvh9-7528 covers an unbounded n parameter on the normal OpenAI completion/chat generation routes. Its root cause is missing upper-bound validation for generated sequence count, its sink is request fanout and request-object copying into the async engine path before scheduling, its precondition is a caller-controlled n, and its fix surface is a cap on generated sequence count. This report reaches /v1/completions/derender and /v1/chat/completions/derender, not the normal generate routes; its root cause is unchecked caller-supplied GenerateResponse / choices / tokenids structures, its sink is OnlineDerenderer detokenization and response construction after generation, its precondition is access to the derender API with generated-output-shaped JSON, and its fix surface is derender payload validation before decode. - PR #45390 includes the GHSA-83mh-6mwq-3hg9 batch-message fanout fix class: it bounds the outer BatchChatCompletionRequest.messages conversation list to prevent one request from creating many conversation/request objects before normal generation. This report has no batch conversation list and does not rely on n; one derender request can instead supply oversized nested GenerateResponse choices and token IDs that are detokenized and returned directly. A batch-message maxlength limit would not bound derender generateresponse(s) or per-choice token/logprob structures.

The completed local report titled "Explicit truncationside disables tokenizer-level prompt truncation" is also distinct. That report used /v1/completions and /v1/chat/completions with ordinary prompt text plus truncateprompttokens and explicit truncationside; its root cause was the renderer omitting tokenizer-level maxlength and the pre-tokenization character guard before post-token slicing; its sink was prompt tokenization; and its fix surface was preserving tokenizer-level truncation or rejecting over-budget prompts before tokenization. This derender report uses /v1 derender routes, has no prompt text tokenization or truncation-side control, starts from caller-supplied generated-output token IDs, and needs aggregate bounds on derender generateresponse(s), choices, token IDs, logprobs, parser inputs, and response construction before detokenization.

Other adjacent vLLM advisories for Rust/gRPC token-id and logprob bounds, structured-output grammar amplification, repetition-detection windows, and pooling/rerank batch fanout are distinct. Those issues affect Rust/gRPC request conversion, grammar compilation, scheduler loops, or engine fanout. This issue affects /v1 derender postprocessing of caller-supplied generated-output objects and requires derender-specific request validation before detokenization.

Resources

- vllm/entrypoints/serve/render/apirouter.py - vllm/entrypoints/serve/disagg/protocol.py - vllm/renderers/onlinederenderer.py - vllm/entrypoints/serve/render/serving.py - vllm/entrypoints/openai/apiserver.py - PR #43606: https://github.com/vllm-project/vllm/pull/43606 - PR #44285: https://github.com/vllm-project/vllm/pull/44285 - GHSA-3mwp-wvh9-7528: https://github.com/vllm-project/vllm/security/advisories/GHSA-3mwp-wvh9-7528 - PR #45390: https://github.com/vllm-project/vllm/pull/45390 - Release v0.23.0: https://github.com/vllm-project/vllm/releases/tag/v0.23.0