Database/AI/ML frameworks & serving
vLLM: prompt_logprobs over a KV-connector-cached prefix crashes EngineCore for all co-tenants
Impact
LogprobsTensors.empty_cpu() allocates an uninitialized int32 tensor and the V1 model runner never writes prompt positions that a KV connector reported as already computed. A client sharing the engine can request prompt_logprobs (or echo with logprobs) against a connector-cached prefix, feed garbage token ids into tokenizer decode, and raise an OverflowError that kills EngineCore. Every in-flight request on that engine dies with it, so one tenant takes down the GPUs backing a shared serving replica. On a GPU cloud this is the expensive kind of outage: the model has to reload into HBM before the replica serves again, which is minutes of idle accelerators per crash and is trivially repeatable.
Who can reach it
Network, authenticated as an ordinary API client of the vLLM server (PR:L) - any tenant sharing the engine. Requires a KV connector to be in use so a prefix can be reported as externally cached.
What to do
Upgrade to vLLM 0.31.0 or later and restart the serving processes - a rolling replacement of inference replicas, no node drain. If you cannot upgrade now, reject or strip prompt_logprobs and echo+logprobs at the gateway, or disable the KV connector on affected deployments.
References
Related entries
- Dagster: Vulnerability in Dagster Core prior to 1.13.1CVE-2026-41490 · DagsterHigh
- Gitingest: prefix-only host validation lets crafted URLs leak GitHub tokens to attacker hostsCVE-2026-82289 · Gitingest (_validate_host git host allowlist)High
- TorchServe (gRPC 7070/7071): gRPC ports bound to all interfaces regardless of configCVE-2024-35199 · TorchServe (gRPC 7070/7071)High
- Ollama (GGUF parser): Malformed 4-byte GGUF file crashes the server (two HTTP requests)CVE-2024-39720 · Ollama (GGUF parser)High
- LangChain Core: unescaped 'lc' keys let user data be revived as LangChain objects on loadCVE-2025-68664 · LangChain Core dumps()/dumpd() serializationHigh
- vLLM: out-of-vocabulary stop_token_ids kill EngineCore and take the model server down until restartCVE-2026-100652 · vLLM (Rust HTTP/gRPC frontend, stop_token_ids validation)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.