CVE-2024-8768: vLLM Denial of Service Vulnerability Due to Empty Prompt
Summary
CVE-2024-8768: vLLM denial of service vulnerability. Affects vllm versions < 0.5.5. Fixed in 0.5.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vLLM is a library designed for efficient and scalable language model serving, enabling developers to integrate advanced language processing capabilities into their applications. It supports various functionalities, including text generation and completion tasks. However, a critical vulnerability has been identified that can lead to a denial of service, impacting the availability of the vLLM API server.
Vulnerability Detail
A flaw exists in the vLLM library where a completions API request with an empty prompt causes the vLLM API server to crash. This vulnerability arises from inadequate input validation, allowing an empty prompt to trigger an unhandled exception, leading to a denial of service. The ramifications are significant, as it can disrupt services relying on the vLLM API, affecting applications that depend on language model functionalities.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "vllm==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.5
This is the first release that contains the fix.
pip install --upgrade "vllm==0.5.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, ensure that all API requests to the completions endpoint include a valid, non-empty prompt. Implement input validation in your application to check for empty prompts before sending requests to the vLLM API.
Conclusion
The vLLM library has a critical denial of service vulnerability (CVE-2024-8768) that can be exploited by sending an empty prompt to the completions API. Users are advised to upgrade to version 0.5.5 or later to mitigate this risk. Implementing input validation can also serve as a temporary workaround.
See every vulnerability recorded for vllm →
FAQ
The vulnerability is a denial of service issue caused by sending an empty prompt to the vLLM API, which results in the server crashing.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary impact is service disruption, as applications relying on the vLLM API may become unavailable if the server crashes due to an empty prompt.
Yes, the vulnerability is fixed in version 0.5.5 of the vLLM library. It is recommended to upgrade to this version or later.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for vllm.
