vLLM Package Vulnerability: Denial of Service Risk
An early warning has been issued regarding a potential denial of service vulnerability in the vLLM package, which could be exploited by sending a specific payload in a completions request.
What happened
Reportedly, the vLLM package can be exploited to cause a denial of service by sending a specific payload in a completions request, leading to a fatal crash of the server application. This vulnerability is under investigation and appears to affect multiple versions of the package, from 0.10.1 to 0.23.0, among others. Engineers using the vLLM package are advised to avoid using it with the mentioned payload until a patch is released. For detailed version information, consult the primary sources.
How 0Day mitigates this
vllm is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.