CVE-2026-116178 in vLLM
Summary
by MITRE • 10/25/2026
vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimodal item with repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists, producing a negative text span in Qwen2.5-VL position construction that terminates the engine.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified within vLLM versions prior to 0.30.0 represents a critical denial of service flaw rooted in insufficient input validation during the processing of multimodal data for disaggregated inference endpoints. Specifically, this issue affects the /inference/v1/generate endpoint when handling requests that include complex multimodal metadata. The core technical failure lies in the engine's inability to properly validate and reconcile conflicting or malformed metadata structures before they are processed by the underlying model architecture. When an attacker submits a request containing inconsistent multimodal metadata, such as repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists, the internal state of the inference engine becomes corrupted. This corruption manifests during the position construction phase for models like Qwen2.5-VL, where negative text spans are erroneously generated due to the misalignment between token indices and their corresponding visual embeddings.
From a technical perspective, this vulnerability exploits the assumption that incoming multimodal inputs will adhere strictly to expected structural constraints regarding placeholder ranges and hash consistency checks. The vLLM engine relies on these metadata fields to correctly map input tokens to specific positions within the model's attention mechanism. When the mm_placeholders contain overlapping or invalid ranges, or when there is a discrepancy between the kwargs_data structure and the associated mm_hashes, the position calculation logic fails. This failure results in the creation of negative indices or out-of-bounds references during tensor operations. In Python-based deep learning frameworks like PyTorch, which vLLM utilizes, such index errors typically trigger unhandled exceptions that propagate up through the inference stack, causing the entire engine process to crash and terminate abruptly.
The operational impact of this vulnerability is severe for any deployment relying on disaggregated inference architectures or high-throughput multimodal serving environments. A successful exploitation allows a remote attacker to cause a complete service outage by repeatedly sending crafted requests that trigger these crashes. Since vLLM often operates as a long-running server process handling multiple concurrent connections, the crash of one engine instance can lead to significant downtime and loss of availability for all users interacting with that specific endpoint. This is particularly dangerous in production environments where high availability is paramount, as it enables an unauthenticated attacker to disrupt services without needing valid credentials or prior interaction history beyond a single malformed request.
This vulnerability aligns closely with CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write, although the immediate effect is denial of service rather than arbitrary code execution due to modern memory safety protections in Python. In terms of attack vectors, it falls under ATT&CK technique T1499 Endpoint Denial of Service, specifically leveraging application layer protocols to exhaust resources or crash services. The exploitation requires only network access and knowledge of the API structure, making it a low-complexity threat for any exposed vLLM endpoint.
To mitigate this risk, organizations must immediately upgrade their vLLM installations to version 0.30.0 or later, where these input validation checks have been strengthened to reject malformed multimodal metadata before processing begins. For environments that cannot be updated instantly, implementing strict rate limiting and request size constraints at the network perimeter can help reduce the blast radius of such attacks. Additionally, deploying a web application firewall with rules designed to detect anomalous patterns in JSON payloads containing mm_placeholders or mismatched hash structures may provide an additional layer of defense against exploitation attempts until the underlying software is patched.