What happened
On 2026-09-26 NVD published a cluster of vLLM DoS/resource-limit bypasses fixed in 0.29.0: media fetched/materialized before size/item caps are enforced across four ingress paths; stop_token_ids validated as integers but not against vocabulary range (crash with min_tokens when OOB); cache_salt lacks max-length validation and is processed on the serializer thread; decoder prompt-length validation skipped for skip_prompt_length_check models on the disaggregated endpoint; PyNvVideoCodec sampler-subclass shadowing bypasses decoder limits.
Why it matters
vLLM is the standard self-hosted inference backend for production LLM apps; these are all remote, low-friction ways to crash or exhaust a serving fleet (pre-inference memory/bandwidth burn and worker failures) where the engine is internet-exposed. The aggregation matters: several independent unauthenticated DoS paths fixed in one release.
Attack vector
Unauthenticated clients submit oversized remote/inline media before VLLM_MAX_AUDIO_CLIP_FILESIZE_MB / --limit-mm-per-prompt is enforced (memory+bandwidth exhaustion); out-of-vocabulary stop_token_ids with min_tokens>0 reach MinTokensLogitsProcessor to crash workers; large cache_salt processed on the single EngineCore scheduler thread; overlong decoder prompts in disagg serving overflow a fixed-width NumPy row.
Affected systems
vLLM < 0.29.0 (OpenAI/Anthropic-compatible and disaggregated serving endpoints, chat/batch audio-video decoding, Rust frontend /tokenize and /inference/v1/generate routes).
Mitigation
Upgrade vLLM to 0.29.0 (patch bundles in GHSA-p6g9-7v3x-m8mv, GHSA-3mqx-f33v-vgp9, GHSA-wpww-v874-ph2p, GHSA-jcq2-4gch-5qhf, GHSA-qff2-492f-9fm4, GHSA-v5gm-qgmv-gc6c). Restrict unauth access to the /tokenize route; validate stop token ids upstream.