vLLM versions up to and including 0.29.0 contain a flaw that fails to validate the tp_size parameter on OpenAI-compatible completion endpoints. An attacker can supply arbitrarily large tp_size values in kv_transfer_params, causing the decoder worker to allocate that amount of memory and exhaust the host system’s RAM. The uncontrolled memory allocation aligns with CWE‑770 and CWE‑789 weaknesses and can trigger the kernel OOM‑killer to terminate the offending process, resulting in a denial‑of‑service for the affected deployment.

The vulnerability affects the vllm-project vllm product. All releases through 0.29.0 are impacted. The flaw is triggered by the OpenAI‑compatible completion endpoints exposed by the service.

The CVSS score of 8.7 categorizes this as high severity. The EPSS score of < 1 % indicates that active exploitation is unlikely at this time. The vulnerability is not listed in CISA KEV. Attackers can remotely exploit the exposed completion API by supplying arbitrary tp_size values, which the server accepts without bounds. When such a request reaches the server, the memory allocation is almost deterministic; the OOM killer will terminate the decoder worker, potentially disrupting all concurrent decoding activities until the process is restarted or the system is scaled out.