vLLM: overlong token_ids on the disaggregated serving endpoint crash the worker

Impact

On the disaggregated serving endpoint, a multimodal request builds an EngineInput straight from caller-supplied token_ids without checking them against max_model_len. For processors that skip the prompt-length check (Nemotron Parse, Whisper, FireRedLID are named), the overlong prompt reaches the worker's copy into a fixed max_model_len-wide array and the worker dies. Disaggregated prefill/decode deployments spread one model across several GPU nodes, so losing a worker takes down more than the request that caused it. Affects only those model configurations.

Who can reach it

Any client that can reach /inference/v1/generate on an affected model configuration. This endpoint is normally an internal prefill/decode link rather than a tenant-facing one, so the realistic attacker is someone already inside the serving network or a tenant whose pod can route to it.

What to do

Upgrade to vLLM 0.29.0 and restart the disaggregated serving processes. Until then, keep /inference/v1/generate on a network path reachable only by the paired prefill and decode workers, not by tenant pods.

References

Related entries

• vLLM: out-of-range stop_token_ids trigger a CUDA device assertion and wedge EngineCoreCVE-2026-100654 · vLLM (OpenAI-compatible /v1/completions and /v1/chat/completions, stop_token_ids validation)High
• vLLM (`MediaConnector`): SSRF, recurrence of CVE-2025-6242CVE-2026-24779 · vLLM (`MediaConnector`)High
• vLLM (`load_from_url_async`): Bypass of the CVE-2026-24779 SSRF fixCVE-2026-25960 · vLLM (`load_from_url_async`)High
• picklescan: `scan_pytorch` bypass via forged magic numbersCVE-2026-53875 · picklescanHigh
• torchvision (GIF decoder): Out-of-bounds heap read in `read_from_tensor` GIF decodeCVE-2026-65918 · torchvision (GIF decoder)High
• MLflow: model version creation reads another user's run artifacts without READ permissionCVE-2026-69148 · MLflow tracking server (CreateModelVersion source run/model validation)High