A flaw was found in vLLM. The service fails to properly enforce length limits on input prompts when handling certain multimodal inference requests. A remote attacker with access to the inference service could exploit this vulnerability by submitting an excessively long prompt, causing an internal worker crash and leading to a Denial of Service (DoS).
Last checked: 2026-10-06 21:17 UTC
Proof of concept · CISA Coordinator (Assessed 2026-09-28 18:21 UTC)
Exploit reference · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · View external evidence (Observed 2026-10-06 21:17 UTC)
Fix evidence last checked: 2026-09-27 20:50 UTC