GHSA-ph72-cqr5-qpp7: vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

vLLM versions 0.25.1 and earlier have a security flaw in their scale-out multimodal transport system. When splitting a request into a render step and a separate generate step, the system trusts caller-supplied encoded features without validating them against the active model, allowing authenticated attackers to forge fields that cause crashes, poison shared encoder caches, or lose data integrity.