GHSA-83vm-p52w-f9pw: vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters

Summary

A shape regression in vLLM's extract_hidden_states speculative decoding proposer, introduced when the KV connector interface was refactored in PR #37013, causes a RuntimeError that crashes the EngineCore process. Any request containing repetition_penalty, frequency_penalty, or presence_penalty triggers the crash, affecting deployments from v0.18.0 through v0.19.1 inclusive.

Mitigation

Fixed in PR #38610, first included in vLLM v0.20.0 (the fix slices the return value to sampled_token_ids[:, :1]). Workarounds: upgrade to vLLM v0.20.0 or later; if upgrading is not possible, avoid extract_hidden_states as the speculative decoding method on affected versions; or reject or strip the penalty parameters from incoming requests at an API gateway before they reach vLLM.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• vllmPyPILLM dependency since 2023-08-25 · 15 tracked dependents

Topics

• Inference infrastructure

Related items

• MediumGHSA-h7c4-q426-7jh9: tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clientsSimilar attack · GitHub Advisory Database
• HighGHSA-4p8p-pjpq-2w7h: tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processSimilar attack · GitHub Advisory Database
• HighGHSA-447x-qqwf-m7xq: tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoSSimilar attack · GitHub Advisory Database
• LowChatter Attack: Resource Consumption Attack for Large Language ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• HighCVE-2026-123356: GROBID unauthenticated thread exhaustion through /api/modelTraining endpointSimilar attack · NVD/CVE Database