# vLLM OpenAI-Compatible Serving Path Resource Teardown DoS Payload

- **Severity:** High
- **Signature ID:** `7b3c9f2e-5a41-4d86-9c07-2f8e6b1a4d53`

## Summary

This rule flags single API requests to a vLLM model-serving endpoint that contain parameter values no normal client would ever send, such as negative or absurd token limits. These malformed requests can trigger a resource cleanup bug in vLLM 0.19.0's OpenAI-compatible server, causing the inference service to fail.

## How the attack works

An attacker sends one HTTP request to an OpenAI-compatible completion or chat endpoint served by vLLM. The request body contains out-of-contract values in resource-control fields: negative or extremely large max_tokens, n, best_of, or logprobs; out-of-vocabulary logit_bias or prompt token IDs; a malformed stream_options; or an invalid truncate_prompt_tokens. vLLM's request handler mishandles these values during its resource teardown path, which can crash or degrade the inference tier from a single request rather than a flood of traffic.

## Why it matters

A single crafted request can disrupt or crash a self-hosted vLLM inference service, denying model access to legitimate users until the service is restarted.

## What you can do

- Validate and clamp all resource-control parameters (max_tokens, n, best_of, logprobs, truncate_prompt_tokens) server-side before they reach vLLM's request handler.
- Reject requests with negative values outside a documented sentinel set, or with logit_bias/prompt token IDs outside the model's vocabulary.
- Patch or upgrade vLLM past the version affected by this teardown bug once a fix is available, and test the fix against your own fuzzing suite.
- Treat this detection as report-only at first: baseline it against legitimate batch-evaluation, best-of-N sampling, and fuzzing traffic before blocking on it.

## Known benign look-alikes

- Batch-evaluation or best-of-N sampling harnesses that legitimately request n or best_of >= 1000 against a self-hosted vLLM endpoint.
- Homegrown SDKs that use a negative sentinel other than -1 to mean "unbounded"; -1 is already excluded for max_tokens and truncate_prompt_tokens, but -2 or lower will match.
- Robustness / fuzzing test suites that deliberately send out-of-contract parameters to a staging inference endpoint.
- Security researchers or red teams replaying the public PoC body; largely suppressed by filter_security_discussion, but a bare JSON paste with no advisory wording will still fire.
- API-client generators or integration tests that emit a stream_options value of the wrong JSON type while scaffolding.
- Very long-context models with genuinely large max_tokens — the threshold is 100,000,000, far above any deployed context window, so this should not occur in practice.

## References

- https://attack.mitre.org/techniques/T1499/004/
- https://docs.vllm.ai/en/latest/serving/openai_compatible_server.html

---
Source: https://www.netzilo.com/threats/vllm-openai-serving-resource-teardown-dos