CVE-2024-8939

Advisory

Improper handling of the 'best_of' parameter in the ilab model serve component's vllm JSON web API can lead to a Denial of Service (DoS) vulnerability. When attackers set this parameter to a large value during LLM-based sentence or chat completion requests, the API fails to manage timeouts or resource exhaustion effectively. This oversight allows malicious actors to consume excessive system resources, rendering the API unresponsive and blocking legitimate users from accessing the service. The vulnerability stems from the API's attempt to return the best completion from several options without proper safeguards against resource-intensive requests.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/vllm-project/vllm/issues/6137
• https://github.com/advisories/GHSA-wc36-9694-f9rf
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8939