Improper Input Validation in vLLM EngineCore

Executive Summary

vLLM versions 0.22.0 to 0.23.x contain an improper input validation flaw in the Rust gRPC Generate and GenerateStream services. Attackers can send requests with invalid prompt token IDs that bypass the tokenizer and directly reach EngineCore, causing a fatal embedding lookup failure. This crashes EngineCore and leaves the server in an unhealthy state.

Useful 0 Not Useful 0

Detection Guidance

Monitor vLLM server logs for fatal embedding lookup failures or EngineCore crashes after receiving requests with out-of-vocabulary token IDs. Check for gRPC Generate or GenerateStream service errors. Use network traffic analysis to detect unusual token ID values in requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to perform a denial-of-service (DoS) attack by sending a single malicious request. If the gRPC endpoint is network-reachable, it can crash the server, making it unavailable for legitimate users. The server remains unhealthy until manually restarted.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability causes a denial-of-service condition by crashing the vLLM server, which could disrupt services handling sensitive data. This may impact compliance with GDPR (availability requirements) and HIPAA (service continuity for protected health information) if the affected system processes regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade vLLM to version 0.24.0 or later immediately. If upgrading is not possible, restrict network access to the gRPC Generate and GenerateStream services or implement token ID range validation similar to the HTTP routes.

Useful 0 Not Useful 0