Denial of Service in vLLM EngineCore via OverflowError

Executive Summary

This is a cross-tenant denial of service (DoS) vulnerability in vLLM versions 0.8.5 to 0.31.0. It occurs due to uninitialized memory in the LogprobsTensors.empty_cpu() function, which allocates an uninitialized int32 tensor. When a client sends a request with prompt_logprobs or echo with logprobs against a cached prefix, an OverflowError is triggered during tokenizer decoding. This crashes the EngineCore and disrupts all co-tenant requests.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the vLLM version and inspecting the code for the specific flaw in LogprobsTensors.empty_cpu(). Use commands like 'pip show vllm' to check the installed version. If the version is between 0.8.5 and 0.31.0, the system is vulnerable. Inspect the file vllm/v1/outputs.py for the use of torch.empty() in LogprobsTensors.empty_cpu().

Monitor for crashes in the vLLM engine process, especially after processing requests with prompt_logprobs or echo with logprobs. Check logs for OverflowError during tokenizer.decode() and EngineCore crashes.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows a single malicious client to crash the entire vLLM engine, affecting all other tenants sharing the same engine. This results in service disruption, downtime, and potential loss of availability for all users. The impact is severe in multi-tenant environments where co-tenants rely on the same shared resources.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes a denial-of-service (DoS) condition that crashes the vLLM engine, disrupting all co-tenant requests. While it does not directly expose or leak data, the resulting service disruption could impact availability requirements under GDPR (Article 32) and HIPAA (Security Rule). Organizations processing sensitive data under these regulations may face compliance risks if the DoS leads to prolonged downtime or degraded service quality.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade vLLM to version 0.31.0 or later, which patches the issue by replacing torch.empty() with torch.zeros() and torch.full(-inf). Alternatively, disable KV connectors if they are not required.

Strip prompt_logprobs from API requests at the gateway level to prevent triggering the flaw. Apply the one-line patch replacing torch.empty() with proper initialization in LogprobsTensors.empty_cpu().

Useful 0 Not Useful 0