Denial of Service in vLLM via Incomplete Metadata Handling

Executive Summary

This is a denial of service vulnerability in vLLM versions up to 0.29.0. It affects the NIXL connector's metadata handling in prefill/decode disaggregated deployments. Attackers can exploit it by sending requests with incomplete kv_transfer_params dictionary entries, causing an uncaught KeyError in EngineCore scheduling. This terminates the decode engine and fails all routed requests until a manual restart.

Useful 0 Not Useful 0

Detection Guidance

Detect this vulnerability by monitoring for crashes or terminations of the decode engine in vLLM deployments using NIXL connector. Check logs for KeyError exceptions in EngineCore scheduling related to kv_transfer_params. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

If you use vLLM versions through 0.29.0 with disaggregated prefill/decode deployments, an attacker could disrupt service by sending malformed requests. This would cause the decode engine to crash, making all routed requests fail until you manually restart the system. Downtime and service unavailability are the primary impacts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to service disruptions, which may impact compliance with availability requirements in GDPR (Article 32) and HIPAA (Security Rule). Unplanned downtime could result in violations if systems are not restored promptly, potentially affecting data accessibility and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade vLLM to a version beyond 0.29.0 where this issue is resolved. If upgrading is not possible, restrict network access to the NIXL connector or disable disaggregated prefill/decode deployments until a patch is applied.

Useful 0 Not Useful 0