vLLM: no upper bound on the n parameter lets a single request OOM the API server

Impact

The Pydantic models for chat and text completion accept an arbitrarily large n, and vLLM materialises that many request-object copies on the heap before the request ever reaches the scheduler. One HTTP request blocks the asyncio event loop and then crashes the process out of memory. The whole endpoint stops serving, not just the offending request, and recovery means reloading model weights onto the GPU — so a single packet costs the fleet minutes of idle accelerator. The advisory describes the attacker as unauthenticated; the CVSS vector assigned to the record says PR:L, so treat any client able to reach the API as capable of triggering it.

Who can reach it

Any client that can reach the vLLM HTTP API and submit a completion request. The vendor description states no authentication is required; the scored vector assumes a low-privilege credential. Either way this is reachable by any tenant sharing the inference endpoint.

What to do

Upgrade to vLLM 0.19.0 or later and restart the serving processes; roll replica by replica to avoid a full outage, accepting a weight reload per worker. Red Hat errata cover AI Inference Server, RHEL AI 3 and OpenShift AI. Until patched, reject or clamp the n field at the gateway in front of vLLM. No node drain or reboot.

References