vLLM is a model serving engine that handles large language model inference through a REST‑style API. Between versions 0.19.0 and 0.25.x the completions endpoint accepted a prompt field of type list[ str ] or list[ list [ int ] ]. For each element of this list the code call expansion logic created a separate engine request and a response buffer. An attacker with an authenticated API key could therefore send a single request with an arbitrarily long prompt list, causing the server to spawn many parallel engine generators, consume excessive CPU, memory, and queue capacity, and ultimately exhaust the service's resources, resulting in denial of service. The flaw is a classic example of uncontrolled resource consumption (CWE‑400) and resource allocation (CWE‑770).

Affected by this vulnerability are installations of vllm from 0.19.0 up to, but not including, 0.26.0. Any system exposing the /v1/completions API endpoint to authenticated users is at risk. The issue was addressed and vendor released version 0.26.0 as the first safe version.

The CVSS base score of 6.5 indicates a moderate severity. The exploit requires knowledge of the API and authentication credentials; the vulnerability can be triggered by sending a carefully crafted prompt list. Since the EPSS score is 0.00388 (<1%), the exploitation probability is very low but not zero, though the failure manifests only when a large payload is accepted, making it more likely to impact production if not mitigated. The vulnerability is not yet listed in the CISA KEV catalog, so no widespread active exploitation is known, but the potential for resource exhaustion is significant for high‑traffic deployments.