Jperezdealgaba

A denial of service flaw exists where the `LogprobsTensors.empty cpu()` function in vllm/v1/outputs.py allocates an uninitialized int32 tensor. Additionally, the V1 model runner fails to write prompt positions reported as computed by a KV connector. A client sharing the engine can trigger an `OverflowError` during tokenizer decoding by sending `prompt logprobs` (or echo with logprobs) against a connector-cached prefix. This results in a crash of the EngineCore and the loss of all co-tenant requests.

A denial of service issue exists in the Rust gRPC frontend that allows remote attackers to terminate EngineCore. By sending Generate or GenerateStream requests with `output logprobs` enabled and providing more than 128 `output candidates.token ids`, an attacker can bypass limits and trigger a fatal sampler exception, resulting in an engine crash.

Improper input validation in the Rust gRPC Generate and GenerateStream services allows the forwarding of unchecked prompt token IDs to EngineCore. An attacker can submit requests containing out-of-vocabulary `prompt.token ids` values, triggering a fatal embedding lookup failure. This failure terminates EngineCore, resulting in an unhealthy server state.

A decompression bomb issue exists in the AudioMediaIO multimodal path due to the `load audio()` function being called without a `max duration s` decoded-duration limit. Authenticated attackers can exploit this by sending small compressed audio files via the `input audio` or `audio url` parameters in the '/v1/chat/completions' endpoint. These files expand into massive decoded PCM (Pulse Code Modulation, a raw audio format), leading to server memory exhaustion.

A server-side request forgery issue allows API callers to force outbound connections by embedding a decode address in the `X-Request-Id` header. This can lead to a P2pNcclConnector prefill worker performing a ZMQ-connect to an attacker-controlled host, resulting in the leakage of the NCCL `unique id` and KV-cache tensors, or causing the worker to be blocked.

Unauthenticated attackers can cause memory exhaustion because Nemotron-VL processors globally set `Image.MAX IMAGE PIXELS` to None. By submitting a pathological decompression-bomb image to the '/v1/chat/completions' endpoint, an attacker can trigger an Out-Of-Memory (OOM) kill of the worker, resulting in a denial of service for other tenants.

A denial of service issue allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated '/inference/v1/generate' endpoint. This occurs when a valid multimodal item is replayed with repeated or overlapping `mm placeholders` ranges, or when `kwargs data` and `mm hashes` lists are mismatched. These actions result in a negative text span during Qwen2.5-VL position construction, which terminates the engine.

A resource exhaustion issue allows API clients to bypass the video/jpeg frame-count limit. By overriding the `num frames` variable through `media io kwargs`, an attacker can set `num frames` to -1 while providing a large inline video. This causes the `VideoMediaIO.load base64()` function to decode every frame, leading to memory exhaustion and a crash of the API frontend.

Improper input validation allows remote attackers to crash the engine or cause a write operation outside the V2 runner's logits buffer. This occurs when out-of-vocabulary `stop token ids` are supplied via OpenAI chat, completion, generate, or batch requests.

Improper input validation in the Rust gRPC converter allows remote attackers to bypass `max logprobs` limits. By sending Generate or GenerateStream requests with oversized or integer-wrapping values in the `CandidateTokens.top n` variable, an attacker can trigger `torch.topk()` failures, which results in the termination of EngineCore.

An uncontrolled resource consumption issue allows remote clients to manipulate multimodal processor parameters by providing per-request `mm processor kwargs`. Attackers can specify excessive values for image size, patch count, crop count, or frame count within processors such as Isaac, InternVL, and H2OVL to exhaust system memory and cause the shared server to terminate.

A cross-request mask leak exists in the `condense()` function of the InputBatch class. This issue allows remote attackers to constrain the outputs of other clients by leaving stale `allowed token ids` rows. By submitting concurrent constrained generate requests, including through the unauthenticated '/invocations' endpoint, attackers can cause recycled batch slots to apply their token allowlist to the unrestricted requests of other users.

The software uses a client-supplied multimodal `uuid` verbatim as a cache identity without performing consistency checks on cache hits. This allows unauthenticated attackers to desynchronize the P0/P1 processor caches, triggering a fatal token-placeholder mismatch that crashes the entire serving instance, requiring a restart to recover.

An issue exists where the system fails to validate that `min tokens` is less than or equal to `max tokens` when the `/inference/v1/generate` endpoint receives a null `max tokens` value. This leads to an uncaught `VLLMValidationError` that causes the EngineCore input thread to crash. Consequently, while the `/health` endpoint continues to report a healthy status, all subsequent generation requests are hung. Unauthenticated remote attackers can trigger this state by sending a single request with an oversized `min tokens` value.

A memory exhaustion issue exists in MOSS-Audio model serving where a processor is cached for every distinct `mm processor kwargs` value within an unbounded dictionary. Unauthenticated attackers can exploit this by sending oversized or distinct `mel config` values to the '/tokenize' endpoint, which bypasses the `--api-key` requirement, leading to host memory exhaustion and a crash of the API process.

When `trust remote code` is enabled, the software forwards the request-supplied `mm processor kwargs.code revision` to the Transformers `AutoProcessor.from pretrained` function. This allows clients to select which revision of a model's dynamic processor code is imported. An attacker who controls a revision in the served model repository can send a multimodal request to the unauthenticated '/tokenize' endpoint to execute arbitrary Python code within the vLLM API process.

A cache aliasing issue allows authenticated attackers to cause collisions in shared cache keys. This is achieved by providing caller-controlled values, specifically through the `EXIF ImageID` or `cache salt`. An attacker can use a UUID `EXIF ImageID` to access cached processed media from another request or align the `cache salt` with a LoRA name to reuse the first-block KV state (Key-Value state, which stores processed token information).

The software passes uploaded audio to the PyAV/FFmpeg `av.open()` fallback using only a file-size check, which exposes a heap overflow in the FFmpeg IAMF parser. Authenticated remote attackers can exploit this by repeatedly uploading malformed IAMF containers to the '/v1/audio/transcriptions' endpoint, leading to heap corruption and crashing the API process.

The software fails to validate if the values provided in `stop token ids` are within the model vocabulary or logits range, checking only that they are integers. When `min tokens` is greater than 0, these IDs are used as logits indices to suppress stop tokens. An out-of-range ID triggers a CUDA indexing operation (`index put `), leading to a device-side assertion. An authenticated API user can exploit this by sending a malformed request to the 'POST /v1/completions' or 'POST /v1/chat/completions' endpoints, resulting in a 500 Internal Server Error and placing the EngineCore into a fatal state. This causes a denial of service where subsequent requests fail until the service is restarted. Real-world incidents of this issue being exploited have been reported.

The software fails to enforce the `VLLM MAX AUDIO CLIP FILESIZE MB` limit during multimodal chat audio decoding. This allows unauthenticated clients to bypass file size restrictions by submitting oversized audio files through chat endpoints, leading to excessive consumption of memory and CPU resources during the decoding process.