The vulnerability in vLLM allows an attacker to trigger a denial of service by exploiting a missing prompt-length validation. When a request containing a 'features' payload is sent to the disaggregated serving endpoint /inference/v1/generate, the server constructs an EngineInput directly from the supplied token_ids without checking against the configured maximum model length. For multimodal processors that skip prompt validation, an overlong prompt is forwarded to the worker layer, causing the processing worker to fail. The failure results in an unresponsive service for the affected model.

Vulnerable versions are vllm‑project's vllm library prior to 0.29.0. The issue applies to any deployment that exposes the /inference/v1/generate endpoint for multimodal requests, particularly models that set skip_prompt_length_check to true such as Nemotron Parse, Whisper, and FireRedLID. Systems running vllm 0.28.x or earlier are at risk.

The CVSS score of 7.1 indicates a high-impact vulnerability. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The description does not provide details about authentication; it is inferred that an attacker able to reach the /inference/v1/generate endpoint can send an overlong token_ids list, causing the worker process to fail and rendering the service unresponsive. The likely attack vector is a request to the disaggregated serving endpoint, potentially from any network reachability that exists to the inference service. The failure can degrade availability for legitimate users. Immediate patching mitigates the risk fully; if patching is delayed, restricting access to the endpoint reduces exposure until a fix is applied.