vLLM: Denial of Service via crafted multimodal input in generate endpoint
Summary
vLLM versions from 0.20.0 before 0.30.0 are affected. The disaggregated multimodal /inference/v1/generate endpoint does not properly validate client-supplied multimodal metadata. A remote attacker can replay a valid multimodal item with repeated or overlapping placeholder ranges or mismatched kwargs_data and mm_hashes lists, which crashes the engine (demonstrated with Qwen2.5-VL) and makes the service unavailable until it is restarted. No loss of confidentiality or integrity is documented.
Affected
- vLLM 0.20.0 up to, but not including, 0.30.0
- Multimodal support for the disaggregated /inference/v1/generate endpoint
Fixed in
- vLLM 0.30.0 (vendor advisory GHSA-34qw-q2h2-jp3m, fix PR #51898)
Workaround
Unknown.
- No vendor-documented workaround found.
- General measure: do not expose the inference API to the public internet and limit access to known clients.
Exploitation
- No reported exploitation.
- CISA SSVC assessment: exploitation none, not automatable, partial technical impact.
- Not listed in CISA KEV according to a secondary source.
- No public proof of concept found in our searches, which does not prove that none exists.
Our recommendation
- Inventory all vLLM installations (pip, containers, Red Hat AI images) and record their versions.
- Upgrade to vLLM 0.30.0 or later; test in staging first. Version 0.31.0 or later also covers the separate issue CVE-2026-114051.
- Restrict network access to the inference API to trusted clients only.
- Monitor logs for engine crashes or restarts as an indicator of abuse.
- If you use Red Hat AI Inference Server 3, ask Red Hat for the fix status, as it is listed as deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-34qw-q2h2-jp3m github.com
- VulnCheck advisory www.vulncheck.com
- OSV PYSEC-2026-4353 osv.dev
- OpenCVE CVE-2026-116178 app.opencve.io
- Vulners Red Hat CVE record RH:CVE-2026-116178 vulners.com
- OffSeq Radar CVE-2026-116178 radar.offseq.com
- OSV CVE-2026-114051 (related issue, fixed in 0.31.0) osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:03.
Original description (NVD)
vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimodal item with repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists, producing a negative text span in Qwen2.5-VL position construction that terminates the engine.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.