Database/AI/ML frameworks & serving
vLLM: overlong token_ids on the disaggregated serving endpoint crash the worker
Impact
On the disaggregated serving endpoint, a multimodal request builds an EngineInput straight from caller-supplied token_ids without checking them against max_model_len. For processors that skip the prompt-length check (Nemotron Parse, Whisper, FireRedLID are named), the overlong prompt reaches the worker's copy into a fixed max_model_len-wide array and the worker dies. Disaggregated prefill/decode deployments spread one model across several GPU nodes, so losing a worker takes down more than the request that caused it. Affects only those model configurations.
Who can reach it
Any client that can reach /inference/v1/generate on an affected model configuration. This endpoint is normally an internal prefill/decode link rather than a tenant-facing one, so the realistic attacker is someone already inside the serving network or a tenant whose pod can route to it.
What to do
Upgrade to vLLM 0.29.0 and restart the disaggregated serving processes. Until then, keep /inference/v1/generate on a network path reachable only by the paired prefill and decode workers, not by tenant pods.
References
Related entries
- vLLM: out-of-range stop_token_ids trigger a CUDA device assertion and wedge EngineCoreCVE-2026-100654 · vLLM (OpenAI-compatible /v1/completions and /v1/chat/completions, stop_token_ids validation)High
- vLLM: malformed IAMF audio upload reaches FFmpeg heap overflow and crashes the inference serverCVE-2026-109311 · vLLM (/v1/audio/transcriptions PyAV/FFmpeg audio decode path)High
- vLLM: forged multimodal uuid desynchronizes the processor cache and kills the serving instanceCVE-2026-114050 · vLLM (multimodal processor cache, client-supplied uuid)High
- vLLM: one request with oversized min_tokens kills the EngineCore input thread while /health stays 200CVE-2026-114051 · vLLM (/inference/v1/generate min_tokens validation, EngineCore input thread)High
- vLLM: caller-controlled EXIF ImageID and cache_salt collide cache keys across requestsCVE-2026-114054 · vLLM (multimodal media cache and prefix KV cache key derivation)High
- Flexible GraphRAG: Cypher injection through ingested document content on the FalkorDB backendCVE-2026-114510 · Flexible GraphRAG FalkorDBAdapter (_escape / add_graph_documents Cypher assembly)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.