CVE-2024-8768: vLLM denial of service vulnerability
A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service.
Published Sep 17, 2024
Affected packages
vllm
- Ecosystem
- PyPI
- Affected
- < 0.5.5
- Fixed in
- 0.5.5
- Check
pip show vllm
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-8768
- https://github.com/vllm-project/vllm/issues/7632
- https://github.com/vllm-project/vllm/pull/7746
- https://access.redhat.com/security/cve/CVE-2024-8768
- https://bugzilla.redhat.com/show_bug.cgi?id=2311895
- https://github.com/vllm-project/vllm/commit/e25fee57c2e69161bd261f5986dc5aeb198bbd42
- https://github.com/advisories/GHSA-w2r7-9579-27hf
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More vLLM vulnerabilities
All vLLM entriesCVE-2026-105752
vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle
low3.1Oct 6, 2026CVE-2026-105753
vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core
medium6.5Oct 6, 2026CVE-2026-105754
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
medium6.5Oct 5, 2026CVE-2026-105755
vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`
medium4.2Oct 5, 2026CVE-2026-105756
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
medium6.5Oct 5, 2026CVE-2026-105757
vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)
medium6.5Oct 5, 2026