The vulnerability exists because the derender endpoints in vllm accept GenerateResponse objects containing nested token ID lists from clients and postprocess them without enforcing model context length, max tokens, choice counts, or response size limits. Unlike normal generation paths that enforce these bounds, derender directly decodes and returns the supplied token IDs, causing CPU and memory usage to scale with attacker-controlled input size. The API routes are protected by API key middleware but do not validate or limit the size of the nested token ID arrays. This can lead to uncontrolled resource consumption (CWE-400) and potentially denial of service conditions.

An authenticated API client can cause excessive CPU and memory usage on the server by submitting large or deeply nested generated output payloads to the derender endpoints. This can degrade service availability or cause denial of service due to resource exhaustion. There is no impact on confidentiality or integrity. The vulnerability requires authentication and does not affect normal generation endpoints that enforce output size limits.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the derender endpoints to trusted clients only and monitor usage patterns for unusually large or complex derender requests. Implementing rate limiting or input validation on the size of token ID lists before processing could mitigate exploitation risk.