vllm: Remote DoS in disaggregated multimodal /inference/v1/generate via malicious kwargs_data / mm_placeholders

Summary

The disaggregated multimodal /inference/v1/generate endpoint accepted client-supplied kwargs_data, mm_hashes, and mm_placeholders without checking that the fields described a consistent prompt layout. Replaying a valid multimodal item with repeated placeholder ranges could violate assumptions in Qwen2.5-VL position construction, crash the engine, and make the service unavailable.

The report reproduced the issue on vLLM 0.20.0 and 0.21.0. Multimodal support for this endpoint first shipped in stable v0.20.0; the validation fix first shipped in v0.30.0.

Details

The render endpoint serializes multimodal metadata for a later generate request. The generate endpoint deserializes those client-provided fields and passes them into multimodal input construction. Before validation, repeated or overlapping placeholder ranges and mismatched parallel lists could reach model code that assumes placeholder offsets advance consistently through the prompt. In the reported Qwen2.5-VL path, this could produce a negative text span while constructing multimodal positions and terminate the engine.

Impact

A crafted request to the disaggregated multimodal generate endpoint could cause a fatal worker error and engine shutdown, affecting subsequent requests. The report confirmed the crash with Qwen2.5-VL-3B-Instruct. The endpoint is part of scale-out multimodal serving.

Fix

PR #51898 validates multimodal feature structures before engine handoff. It requires parallel multimodal fields to use matching modalities and list lengths, rejects overlapping or invalid placeholder ranges, and ensures placeholder ranges fit within the prompt token sequence.