PYSEC-2026-4353: vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders
vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimodal item with repeated or overlapping mmplaceholders ranges or mismatched kwargsdata and mmhashes lists, producing a negative text span in Qwen2.5-VL position construction that terminates the engine.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/vllmto a version that resolves this vulnerability.Fixed in 0.30.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using vLLM versions from 0.20.0 up to, but not including, 0.30.0 are affected when the disaggregated /inference/v1/generate endpoint is reachable by a remote attacker and processes multimodal requests.
What does an attacker need to send to trigger the denial of service?
The attacker can replay a valid multimodal item while supplying inconsistent metadata, such as repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists. No privileges or user interaction are required according to the provided severity vector.
What is the operational impact of successful exploitation?
Malformed multimodal metadata can create a negative text span during Qwen2.5-VL position construction, terminating the vLLM engine. The reported impact is availability loss; no confidentiality or integrity impact is indicated.