vLLM — decode-worker memory exhaustion via unbounded rejected-request cleanup in disaggregated prefill/decode deployments

vLLM's disaggregated prefill/decode serving architecture fails to release decode-side metadata for rejected requests, so a stream of max_tokens=0 requests from any unauthenticated client can exhaust worker memory and force restarts.

vLLM is one of the most widely deployed open-source LLM inference engines; an unauthenticated remote DoS against a common production scaling pattern (disaggregated serving) can take down inference capacity for any application depending on it, with no authentication required to trigger.

Remote attackers submit requests with max_tokens=0, which are rejected but whose decode-side metadata is never cleaned up, allowing unbounded accumulation that exhausts decode-worker memory until the worker restarts — a denial-of-service against the inference service.

vLLM through 0.29.0 (disaggregated prefill/decode deployments)

Upgrade to the vLLM patch addressing this issue per the project's GitHub security tracker; monitor decode-worker memory in disaggregated deployments in the interim.