vLLM v0.29.0 unauthenticated generation endpoint can be hung by a single request while health checks still return 200
vLLM：生成请求可导致引擎挂起且健康检查未反映异常
vLLM's /inference/v1/generate path does not fully validate generation parameters; an exception can cause the EngineCore input thread to exit, after which all requests hang while the process and /health still respond normally. The advisory reproduces this in v0.29.0: the endpoint is mounted by default and can be accessed by unauthenticated network clients when --api-key is not set. This example shows that a health check alone cannot prove the inference service is still usable. The GitHub advisory marks affected versions as < 0.31.0 and the fixed version as 0.31.0.
An unauthenticated endpoint in vLLM v0.29.0 can be taken down by a single request, and health checks still return 200, so deployers need to check their exposure surface accordingly.