vLLM EUVD-2026-109439

Exploitation requires the target to run vLLM's disaggregated (scale-out) multimodal serving with the /inference/v1/generate endpoint reachable by the attacker; multimodal support for this endpoint first shipped in v0.20.0, so only 0.20.0 through 0.29.x are affected. The attacker must obtain and replay a valid multimodal item and then submit inconsistent serialized metadata - repeated/overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists. The confirmed crash path is the Qwen2.5-VL position-construction code (reproduced on Qwen2.5-VL-3B-Instruct); whether other multimodal model paths are equally affected is not established in the sources. No authentication is required (PR:N), but the CVSS rates attack complexity high with an attack requirement (AC:H/AT:P), indicating the malicious metadata must satisfy conditions to reach the vulnerable code. Limiting factors: instances not using this disaggregated multimodal endpoint, or on v0.30.0+, are not exposed.

This is a genuine but bounded availability-only risk. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scoring 8.2 shows a network-reachable, unauthenticated flaw (PR:N) whose only impact is on availability (VA:H; VC:N/VI:N - no data exposure or code execution), with elevated attack complexity (AC:H) and a present attack requirement (AT:P). The source evidence does not describe why AC:H/AT:P applies beyond the need to craft inconsistent kwargs_data/mm_placeholders/mm_hashes that survive into Qwen2.5-VL position construction, so the specific precondition behind the complexity rating is not detailed in the available sources. No EPSS score, SSVC automatable/technical-impact decision, or CISA KEV entry is present in the input, so probabilistic and framework signals cannot be weighed. The vuln.today priority is 'this_week' (not act_now/emergency), consistent with a high-severity DoS reported by VulnCheck but without confirmed active exploitation. Exploitation status: no public exploit identified at time of analysis - the researcher reproduced the crash on 0.20.0/0.21.0, but the input provides no publicly available working exploit code and no KEV listing. Net: a real, patch-worthy issue for operators of the affected endpoint, but scoped to denial of service rather than compromise, and prioritization relies on CVSS and the vendor advisory rather than exploitation telemetry (EPSS/KEV absent).

An attacker with network reach to a vLLM instance running the disaggregated multimodal /inference/v1/generate endpoint replays a previously valid multimodal item but tampers with the serialized metadata - repeating or overlapping mm_placeholders ranges, or supplying mismatched kwargs_data and mm_hashes lists. When this inconsistent layout reaches Qwen2.5-VL position construction it yields a negative text span, triggering a fatal worker error that shuts down the engine and denies service to all subsequent requests. No public exploit code is identified, though the reporter (VulnCheck) reproduced the crash on 0.20.0/0.21.0 with Qwen2.5-VL-3B-Instruct.