A vLLM structured output vulnerability can bring down the engine
Start here
A GitHub security advisory discloses that three structured output paths in vLLM—syntax compilation exceptions, negative tokens from speculative decoding, and empty structured constraints accepted by the optional Rust frontend—can let request errors escape to the shared EngineCore. An ordinary API request can terminate the engine, interrupting concurrent and subsequent service for all tenants on that instance. The advisory says the impact is limited to availability, and does not involve code execution, memory corruption, or data leakage. Affected versions are before 0.30.0, and 0.30.0 is fixed.
Generated by AI from reports · Updated 2 days ago
Progress timeline
- GitHub 安全公告SelectedvLLM structured output vulnerability can crash the engine; fixed in 0.30.0
Three structured output paths in vLLM can let request errors escape to the shared EngineCore, including syntax compilation exceptions, negative tokens from speculative decoding, and empty structured constraints accepted by the optional Rust frontend. An ordinary API request can terminate the engine, interrupting concurrent and subsequent service for all tenants on that instance. The impact is limited to availability, and does not involve code execution, memory corruption, or data leakage. The GitHub advisory marks affected versions as < 0.30.0, with the fix in 0.30.0.
Related discussion
Attention trend
New sources per day
- Oct 6: 1 new sources (1 outlets, 0 accounts)
- Oct 7: 0 new sources (0 outlets, 0 accounts)
- Oct 8: 0 new sources (0 outlets, 0 accounts)
- Oct 9: 0 new sources (0 outlets, 0 accounts)
- Oct 10: 0 new sources (0 outlets, 0 accounts)
- Oct 11: 0 new sources (0 outlets, 0 accounts)
- Oct 12: 0 new sources (0 outlets, 0 accounts)
- Oct 13: 0 new sources (0 outlets, 0 accounts)
- Oct 14: 0 new sources (0 outlets, 0 accounts)