EUVD-2026-87745

vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' multimodal payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal EngineInput directly from the caller-supplied...

PT-2026-99322

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.0 Description The software fails to enforce decoder prompt-length validation on the disaggregated serving endpoint '/inference/v1/generate'. When a request includes a 'features' multimodal payload, the system builds...