CyberRota Analysis
AI-GeneratedThe vulnerability in vLLM versions up to 0.29.0 allows attackers to exploit the tp_size parameter in OpenAI-compatible completion endpoints, leading to unbounded memory allocation. This can result in memory exhaustion and trigger kernel OOM-kills on the decode worker process, potentially disrupting service. Organizations utilizing vLLM for AI model deployments should prioritize patching this vulnerability to mitigate the risk of denial-of-service attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel OOM-kill of the decode worker process.
Related CVEs
Other vulnerabilities affecting the same vendor(s)