Description
vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in NixlBaseConnectorWorker._apply_prefix_caching by submitting completion requests with multiple prompts of varying lengths, causing the decode worker to terminate and become unavailable until restarted.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vllm-project | vllm | ≤ 0.29.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | vllm | < 0.30.0 | 0.30.0 | PYSEC-2026-4005 |
Advisories 1
- WID-SEC-2026-3507 vllm: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 9, 2026
References
- Pull Request #51505 issue-tracking patch
- https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/kv_connector/v1/nixl/base_worker.py#L2642-L2646 technical-description
- https://github.com/vllm-project/vllm product
- VulnCheck Advisory: vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure third-party-advisory