vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread

Summary

vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.

Remediation

1. Inventory every Vllm Vllm deployment, including staging.
2. Upgrade Vllm Vllm to 0.31.0.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/vllm-project/vllm/security/advisories/GHSA-4xqp-c3mv-qff7
• Advisoryhttps://www.vulncheck.com/advisories/vllm-before-0.31.0-denial-of-service-via-min-tokens-in-inference-v1-generate