Technical impact
vLLM from version 0.20.0 up to before 0.30.0 is vulnerable to a denial of service condition that can be triggered by remote attackers sending malformed multimodal metadata to the /inference/v1/generate endpoint. By replaying a valid multimodal request with repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists, an attacker can cause the Qwen2.5‑VL component to construct a negative text span during position calculation. This error terminates the engine, effectively crashing the inference service.
Affected Systems
The affected product is vLLM, a project by vllm-project. All installations of vllm version 0.20.0 through any earlier release before 0.30.0 are impacted. No specific patch version is listed for the vulnerable releases, but any release prior to 0.30.0 contains the flaw.
Risk and Exploitability
The CVSS score of 8.2 marks this vulnerability as high severity. EPSS data is not available, so the likelihood of exploitation remains uncertain. The vulnerability is not listed in CISA's KEV catalog, indicating no publicly known widespread exploits. Attackers require only the ability to send HTTP requests to the inference endpoint. The flaw is an input validation weakness, as identified by CWE‑20, and can be exploited remotely by composing malicious multimodal payloads. The lack of mitigations in the current software version means the service is fully vulnerable once exposed.
