CyberRota Analysis
AI-GeneratedThe vulnerability affects the vLLM NIXL connector, specifically in its prefix caching implementation, which improperly validates block counts during multi-prompt completion requests. This flaw allows attackers to induce a denial of service by submitting crafted requests, leading to assertion failures that cause the decode worker to crash and remain unavailable until restarted. Organizations utilizing vLLM, particularly those with disaggregated deployments, should prioritize addressing this issue to maintain service availability and prevent potential disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in NixlBaseConnectorWorker._apply_prefix_caching by submitting completion requests with multiple prompts of varying lengths, causing the decode worker to terminate and become unavailable until restarted.
Related CVEs
Other vulnerabilities affecting the same vendor(s)