The vulnerability in vLLM allows an attacker to trigger a denial of service by exploiting a missing prompt‑length validation. When a request containing a 'features' payload is sent to the disaggregated serving endpoint /inference/v1/generate, the server constructs an EngineInput directly from the supplied token_ids without checking against the configured maximum model length. For multimodal processors that skip prompt validation, an overlong prompt is forwarded to the worker layer where it overflows a fixed‑size NumPy buffer, causing the processing worker to fail. The failure results in an unresponsive service for the affected model.

Vulnerable versions are vllm‑project's vllm library prior to 0.29.0. The issue applies to any deployment that exposes the /inference/v1/generate endpoint for multimodal requests, particularly models that set skip_prompt_length_check to true such as Nemotron Parse, Whisper, and FireRedLID. Systems running vllm 0.28.x or earlier are at risk.

The CVSS score of 7.1 indicates a high impact and medium to high exploitability. Although the EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalog, the presence of an open, unauthenticated inference endpoint provides an attacker with a practical attack vector. Overloading the worker can crash the service or cause the inference server to become non‑responsive, thereby degrading availability for legitimate users. Immediate patching mitigates the risk fully, while temporary network restrictions reduce exposure until a patch is applied.