vLLM models before version 0.31.0 validate the token counts incorrectly when a request to /inference/v1/generate includes a null max_tokens parameter. The EngineCore input thread later receives an oversized min_tokens value without the expected range check and dies with an unhandled VLLMValidationError. Because the /health endpoint is unrelated, it continues to return 200, making the failure invisible to clients. An unauthenticated remote attacker can exploit this by sending a single malformed request that stalls the generation service, causing all subsequent generation requests to hang until the service is manually restarted. The denial of service applies to all workloads relying on that endpoint.

vLLM, managed by the vllm‑project organization, is affected in all releases before 0.31.0. The vulnerability is present in the default installation of vLLM versions older than 0.31.0; there is no version information beyond the prerelease under review.

The CVSS score is 7.1, indicating a substantial risk. The EPSS score is below 1 %, showing a low probability of exploitation in the wild, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is remote and unauthenticated, exploiting the /inference/v1/generate endpoint. An attacker only needs network access to the API and the ability to submit JSON payloads; no special privileges are required. Once triggered, the service is unable to process any further generation requests until it is restarted.