PT-2026-120177

vLLM before 0.31.0 skips the min tokens = max tokens check for /inference/v1/generate requests with a null max tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an...