vLLM OpenAI API: Denial of Service via unbounded 'n' parameter
Overview
A critical Denial of Service (DoS) vulnerability has been identified in the vLLM OpenAI-compatible API server, affecting versions from 0.1.0 up to, but not including, 0.19.0. The core of the issue lies within the Pydantic models for `ChatCompletionRequest` and `CompletionRequest`, which fail to implement an upper bound validation for the `n` parameter. This oversight allows an unauthenticated attacker to craft a single HTTP request and specify an excessively large value for `n`. When such a request is processed, it leads to an immediate and catastrophic system failure. The attack vector exploits the asyncio event loop by triggering the allocation of millions of request object copies on the heap. This memory exhaustion occurs before the request even enters the request scheduling queue, effectively rendering the vLLM service unresponsive and causing Out-of-Memory (OOM) crashes. The lack of input sanitization on this specific parameter is the primary cause, enabling a simple yet devastating attack.
Affected Systems
Testing Guide
1. Identify the vLLM service endpoint. 2. Craft an HTTP POST request to the `/v1/chat/completions` or `/v1/completions` endpoint. 3. In the request body, set the `n` parameter to an extremely large integer (e.g., `999999999999999999`). 4. Observe the vLLM service's response. A successful exploitation will result in the service becoming unresponsive, potential server crashes, or significant resource exhaustion (OOM errors).
Mitigation Steps
- Update vLLM to version 0.19.0 or later. - Implement a custom API gateway or ingress controller to enforce request size limits and validate `n` parameter values. - Regularly monitor system resource utilization (CPU, memory) for unusual spikes. - Consider rate limiting for API endpoints to mitigate impact from repeated or malformed requests.
Patch Details
vLLM version 0.19.0