vLLM: inconsistent multimodal metadata on the disaggregated generate endpoint crashes the engine

CVSS 8.2CVE-2026-116178AI/ML frameworks & servingcurated

Impact

The disaggregated /inference/v1/generate endpoint accepts multimodal metadata without checking it for internal consistency. Replaying a valid multimodal item with repeated or overlapping mm_placeholders ranges, or with mismatched kwargs_data and mm_hashes lists, produces a negative text span during Qwen2.5-VL position construction and terminates the engine. Disaggregated prefill/decode deployments are exactly the ones where an engine death is expensive: the crashed role has to come back and reload weights before the pipeline serves again, and every tenant routed through it stalls. Affects 0.20.0 through 0.29.x.

Who can reach it

Network, unauthenticated - any caller able to reach the disaggregated /inference/v1/generate endpoint. These internal disaggregation endpoints are often left on a cluster network with no auth, which is where the real exposure lies.

What to do

Upgrade to vLLM 0.30.0 or later and restart the serving processes - rolling restart of prefill/decode engines, no node drain. Until then, restrict the disaggregated endpoint to the internal path between prefill and decode workers with network policy, and do not let tenant traffic reach it directly.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-116178 https://github.com/vllm-project/vllm/security/advisories/GHSA-34qw-q2h2-jp3m https://www.vulncheck.com/advisories/vllm-0.20.0-before-0.30.0-dos-via-inference-v1-generate-mm-placeholders

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.