The vLLM inference and serving engine for large language models has a resource allocation vulnerability (CWE-770) in versions >=0.1.0 and <0.19.0. Specifically, the OpenAI-compatible API server does not enforce an upper limit on the 'n' parameter in ChatCompletionRequest and CompletionRequest Pydantic models. An unauthenticated attacker can exploit this by sending a single HTTP request with an astronomically large 'n' value, causing the Python asyncio event loop to block and triggering immediate out-of-memory crashes due to massive heap allocations before the request reaches the scheduler. This denial of service vulnerability is resolved in vLLM 0.19.0. The CVSS 3.1 base score is 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. Red Hat has published an advisory referencing this CVE but does not explicitly state a patch or fix version for their AI Inference Server product. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.

An unauthenticated attacker can cause a denial of service by sending a single specially crafted HTTP request with a very large 'n' parameter value. This leads to blocking of the Python asyncio event loop and immediate out-of-memory crashes due to excessive memory allocation. The impact is limited to availability disruption; confidentiality and integrity are not affected.

The vulnerability is fixed in vLLM version 0.19.0. Users should upgrade to vLLM 0.19.0 or later to remediate this issue. The Red Hat advisory referencing this CVE does not explicitly confirm a patch or fix availability for their AI Inference Server product, so users should consult the vendor advisory for the latest remediation guidance. Until patched, consider restricting access to the vulnerable API endpoints or implementing request size limits at network or application layers to mitigate exploitation risk.