CVE-2026-100651: vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1

vLLM versions before 0.29.0 have a vulnerability where the /inference/v1/generate endpoint doesn't properly check if decoder prompts (the input text converted to tokens) are too long for the model when processing multimodal requests (requests with images, audio, or other non-text data). Certain multimodal processors skip this length validation entirely, allowing attackers to send excessively long token sequences that crash the system and cause a denial of service (making the service unavailable).