CVE-2026-100651: vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass

Vulnerability summary

CVE-2026-100651 is a high (CVSS 7.1) Uncontrolled Resource Consumption vulnerability in vllm-project vllm. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 25% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-09-2026
   PublishedVulnerability first disclosed.
2. 28-09-2026
   Last modifiedVulnerability information updated.

Description

vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' (multimodal) payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal EngineInput directly from the caller-supplied token_ids, and GenerateRequest.token_ids (vllm/entrypoints/serve/disagg/protocol.py) is not checked against model_config.max_model_len. For multimodal processors that report skip_prompt_length_check=True (for example Nemotron Parse, Whisper, and FireRedLID), InputProcessor._validate_prompt_len() returns immediately for both encoder and decoder prompts, so an overlong prompt becomes an EngineCoreRequest and reaches the worker input-batch copy into a fixed max_model_len-wide NumPy row. A client able to reach the endpoint on an affected model configuration can therefore submit an overlong token_ids list to trigger a worker failure and denial of service. Fixed in 0.29.0.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.