CyberRota Analysis
AI-GeneratedThe vLLM inference engine prior to version 0.30.0 is vulnerable due to its Rust frontend's track_http_metrics middleware, which allows unauthenticated attackers to send arbitrary HTTP method tokens to unprotected routes, leading to excessive memory usage and potential service exhaustion. This vulnerability can impact systems using vLLM for large language model inference and monitoring, particularly those exposing metrics endpoints. Organizations utilizing affected versions should prioritize upgrading to version 0.30.0 to mitigate the risk of resource exhaustion and ensure service stability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus's Family::get_or_create function to permanently create counter and histogram label sets. Those label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted. This issue is fixed in version 0.30.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)