CyberRota Analysis
AI-GeneratedPrior to version 0.30.0, vLLM, an inference and serving engine for large language models, is vulnerable to structured-output request failures that can bypass request-scoped validation, potentially leading to fatal errors in the EngineCore. This vulnerability may allow for backend mismatches and improper token handling, which could disrupt service and compromise the stability of the engine. Organizations utilizing vLLM for large language model inference should prioritize upgrading to version 0.30.0 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust frontend can admit empty structured-output values that the Python frontend rejects, allowing ordinary constrained-generation requests to terminate the shared engine. This issue is fixed in version 0.30.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)