REDHAT-BUG-2311895: High severity vllm vulnerability
A completions API request with an empty prompt will crash the vllm API server.
The impact is limited based on what model is being served. Serving gpt2 is affected. Most models are not affected, as vllm will prepend tokens to the prompt, avoiding the problematic code.
https://github.com/vllm-project/vllm/commit/e25fee57c2e69161bd261f5986dc5aeb198bbd42
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2311895?
The severity of REDHAT-BUG-2311895 is considered moderate, as it causes the vllm API server to crash with an empty prompt but primarily affects the GPT-2 model.
How do I fix REDHAT-BUG-2311895?
To fix REDHAT-BUG-2311895, ensure that prompts sent to the vllm API server are not empty, or update to the latest version of the vllm software that addresses this issue.
What models are affected by REDHAT-BUG-2311895?
Only the GPT-2 model is directly affected by REDHAT-BUG-2311895; most other models are not impacted due to token prepending.
What happens when a completions API request with an empty prompt is made in REDHAT-BUG-2311895?
Making a completions API request with an empty prompt will crash the vllm API server, leading to potential service downtime.
Is the impact of REDHAT-BUG-2311895 dependent on the model being served?
Yes, the impact of REDHAT-BUG-2311895 is dependent on the model being served, with GPT-2 being affected and other models generally being safe.