vLLM OpenAI-Compatible Serving Path Resource Teardown DoS Payload

How the attack works

An attacker sends one HTTP request to an OpenAI-compatible completion or chat endpoint served by vLLM. The request body contains out-of-contract values in resource-control fields: negative or extremely large max_tokens, n, best_of, or logprobs; out-of-vocabulary logit_bias or prompt token IDs; a malformed stream_options; or an invalid truncate_prompt_tokens. vLLM's request handler mishandles these values during its resource teardown path, which can crash or degrade the inference tier from a single request rather than a flood of traffic.

Netzilo detection

Why it matters

A single crafted request can disrupt or crash a self-hosted vLLM inference service, denying model access to legitimate users until the service is restarted.

What you can do

• →Validate and clamp all resource-control parameters (max_tokens, n, best_of, logprobs, truncate_prompt_tokens) server-side before they reach vLLM's request handler.
• →Reject requests with negative values outside a documented sentinel set, or with logit_bias/prompt token IDs outside the model's vocabulary.
• →Patch or upgrade vLLM past the version affected by this teardown bug once a fix is available, and test the fix against your own fuzzing suite.
• →Treat this detection as report-only at first: baseline it against legitimate batch-evaluation, best-of-N sampling, and fuzzing traffic before blocking on it.

Known benign look-alikes

• Batch-evaluation or best-of-N sampling harnesses that legitimately request n or best_of >= 1000 against a self-hosted vLLM endpoint.
• Homegrown SDKs that use a negative sentinel other than -1 to mean "unbounded"; -1 is already excluded for max_tokens and truncate_prompt_tokens, but -2 or lower will match.
• Robustness / fuzzing test suites that deliberately send out-of-contract parameters to a staging inference endpoint.
• Security researchers or red teams replaying the public PoC body; largely suppressed by filter_security_discussion, but a bare JSON paste with no advisory wording will still fire.
• API-client generators or integration tests that emit a stream_options value of the wrong JSON type while scaffolding.
• Very long-context models with genuinely large max_tokens — the threshold is 100,000,000, far above any deployed context window, so this should not occur in practice.

References

• https://attack.mitre.org/techniques/T1499/004/
• https://docs.vllm.ai/en/latest/serving/openai_compatible_server.html