vLLM Engine Crash via Inconsistent Multimodal Metadata

Executive Summary

vLLM versions 0.20.0 to 0.29.0 are vulnerable to a denial of service (DoS) attack via the /inference/v1/generate endpoint. The issue stems from improper input validation when handling multimodal metadata, specifically the mm_placeholders parameter. Attackers can send inconsistent or malformed multimodal data, such as replaying valid items with overlapping or repeated mm_placeholders ranges or mismatching kwargs_data and mm_hashes lists. This causes a negative text span during Qwen2.5-VL position construction, leading to engine crashes.

Useful 0 Not Useful 0

Detection Guidance

Monitor network traffic for repeated or overlapping mm_placeholders ranges in requests to the /inference/v1/generate endpoint. Check for mismatched kwargs_data and mm_hashes lists in multimodal payloads. Logs showing negative text span errors during Qwen2.5-VL position construction may indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to crash the vLLM engine by sending specially crafted multimodal metadata. The impact includes service unavailability as the engine terminates, making it unable to process subsequent requests. No privileges or user interaction are required for exploitation, and the attack can be performed remotely over the network.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade vLLM to version 0.30.0 or later to apply the input validation fixes. Temporarily restrict access to the /inference/v1/generate endpoint if immediate upgrade is not possible. Implement network monitoring to detect and block malformed multimodal requests.

Useful 0 Not Useful 0