An unauthenticated denial of service vulnerability in vLLM can be exploited by remote attackers to crash inference engines via memory exhaustion.

This is a resource consumption vulnerability (CWE-400) where the application fails to properly limit the size of incoming HTTP headers. An unauthenticated remote attacker can trigger this vulnerability by sending a single malicious GET request, forcing the server to exhaust its available memory.

Successful exploitation of this vulnerability results in service disruption, as the inference engine will likely crash or become unresponsive. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to the availability of AI-driven applications and services that rely on vLLM for model serving, potentially leading to operational downtime and business process interruptions.

Immediate Action: Update the vLLM package to version 0.10.1.1 or later immediately to incorporate the necessary resource handling fixes.

Proactive Monitoring: Monitor server resource utilization logs for unusual memory spikes or frequent service restarts that may indicate attempted exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) or an API gateway in front of the vLLM service to enforce strict limits on incoming request header sizes and reject oversized requests.

Public Exploit Available: Unknown.

This vulnerability represents a critical threat to service availability for organizations deploying vLLM. IT and security teams must prioritize the update to version 0.10.1.1 as soon as possible. In environments where immediate patching is not feasible, deploying edge-level request filtering is essential to prevent potential service outages caused by malicious actors.