vLLM versions through 0.29.0 suffer a denial of service vulnerability in the NIXL connector. The prefix caching implementation fails to validate block counts when multiple prompts of differing lengths are processed in a prefill/decode disaggregated deployment. An attacker can submit such completion requests to the API, causing an assertion failure in the NixlBaseConnectorWorker._apply_prefix_caching method. The assertion failure terminates the decode worker, leaving it unavailable until a restart occurs, which disrupts normal operation and availability of the service.

The affected product is vllm from the vllm-project. Users running vllm version 0.29.0 or earlier are impacted. The patch is incorporated in later releases following the pull request merged in the project repository.

The CVSS score of 8.7 indicates a high severity vulnerability. EPSS is not available, and it is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending crafted completion requests through the public or internal API that include multiple prompts of varying lengths. Failure of the worker is not dependent on privileged access, meaning any entity capable of interacting with the model can trigger the denial of service. Prompting a series of multi‑prompt requests can quickly exhaust resources until a manual restart is performed.