AIKIDO-2026-889587
vllm is vulnerable to Denial of Service (DoS)
43
Medium Risk
This Affects:
vllmTL;DR
The derender endpoints accept caller-supplied response objects and detokenize every nested token-id list without enforcing model context length, output-token, choice-count, or response-size limits. A client can submit oversized nested token structures that the server decodes and buffers directly, consuming CPU and memory proportional to the attacker-chosen payload. This can degrade availability for other clients sharing the process. The fix validates derender payload sizes against the same bounds generation would enforce before decoding.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose the completions or chat-completions derender endpoints to API clients.
Background info
vllm is vulnerable to Denial of Service (DoS) in versions 0.24.0 - 0.25.1.
How to fix this
Upgrade the vllm library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant