AIKIDO-2026-856158
vllm is vulnerable to Denial of Service (DoS)
65
Medium Risk
This Affects:
vllmTL;DR
The completions endpoint accepts the prompt field as a list of prompts without any outer count bound. Each element is expanded into a separate engine request with its own generator and response slot, so one request fans out into an attacker-chosen number of backend subrequests. A large prompt list consumes CPU, memory, scheduling, and engine slots, starving other tenants on the same server. The fix rejects oversized prompt lists before the renderer expands them.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose the completions endpoint to untrusted or semi-trusted API clients.
Background info
vllm is vulnerable to Denial of Service (DoS) in versions 0.19.0 - 0.25.1.
How to fix this
Upgrade the vllm library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant