{"id":"GHSA-mwgq-9582-w2vf","kind":"vulnerability","aliases":["GHSA-mwgq-9582-w2vf"],"related":[],"title":"Response amplification in OpenAI validation error handler","description":"This was reported as a normal pull request by @hclsys.\n\n## Summary\n\nThe OpenAI-compatible API server's shared `RequestValidationError` handler rendered all validation errors in its HTTP 400 response. Pydantic errors can include the full offending input, so a single malformed request that generates many errors can cause the same input to be serialized repeatedly.\n\n## Impact\n\nAn API client can trigger a disproportionately large error response. Formatting and sanitizing it consumes CPU and memory on the server, and buffering it can disrupt downstream clients and proxies. @rmonsurate originally reported the behavior on `POST /v1/responses` in [issue #49239](https://github.com/vllm-project/vllm/issues/49239).\n\n## Fix\n\nThe shared handler now limits the number of rendered errors and summarizes oversized input values before formatting. It still reports the total error count and how many entries were omitted. The fix bounds error-response rendering. Initial request validation and collection of validation errors still occur.\n\nA fix for this was introduced in https://github.com/vllm-project/vllm/pull/54684.","summary":"The OpenAI-compatible API server in vLLM echoed full offending input into every validation error in HTTP 400 responses. A single malformed request producing many errors makes the server spend extra CPU and memory formatting a very large response.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vllm","fixed":["0.30.0"],"affected":">= 0.3.0, < 0.30.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","llm-serving","python","self-hosted","vllm"],"not_affected_if":["no-public-api-access","version-0.30.0-or-later"],"how_to_check":"- Check the installed vLLM version with `pip show vllm` and compare it to the affected range (>= 0.3.0, < 0.30.0)\n- Look for the OpenAI-compatible server (`vllm serve`) exposed to clients you do not fully trust\n- Confirm the running version with the `version` field of the server's responses or the process's package version","fix":"- `vllm` `0.30.0` (fixed version per the product data; the fix limits rendered errors and summarizes oversized input values)","status":"open","published_at":"2026-11-07T08:04:02+00:00","first_seen_at":"2026-11-09T22:53:23+00:00","triaged_at":"2026-11-09T22:56:25+00:00","updated_at":"2026-11-09T22:56:25+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:56:25Z","model":"claude-haiku-5-5","output":{"fix":"- `vllm` `0.30.0` (fixed version per the product data; the fix limits rendered errors and summarizes oversized input values)","reach":"network","title":"vLLM: oversized validation error responses can exhaust server CPU and memory","impact":"low","summary":"The OpenAI-compatible API server in vLLM echoed full offending input into every validation error in HTTP 400 responses. A single malformed request producing many errors makes the server spend extra CPU and memory formatting a very large response.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["vllm","python","self-hosted","llm-serving"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker drives server CPU and memory use with crafted requests","analyst_note":"","how_to_check":"- Check the installed vLLM version with `pip show vllm` and compare it to the affected range (>= 0.3.0, < 0.30.0)\n- Look for the OpenAI-compatible server (`vllm serve`) exposed to clients you do not fully trust\n- Confirm the running version with the `version` field of the server's responses or the process's package version","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.30.0-or-later","no-public-api-access"],"who_is_affected":"Teams running the vLLM OpenAI-compatible API server at versions from 0.3.0 up to but not including 0.30.0 are exposed, especially if clients outside their control can send requests to it. Deployments that only serve trusted internal callers are lower risk, and the fix is only in the shared validation error handler, so other endpoints are not described as affected by this text.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000793,"input_tokens":4870,"output_tokens":613,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'/v1/responses':164C '/vllm-project/vllm/issues/49239).':170C '/vllm-project/vllm/pull/54684.':228C '400':48B,98C '49239':167C '9582':11A,16A 'ai':20B 'ai-tool':19B 'amplif':2A 'api':34B,85C,128C 'behavior':161C 'bound':204C 'buffer':149C 'caus':118C 'client':129C,154C 'collect':213C 'compat':33B,84C 'consum':141C 'count':195C 'cpu':62B,142C 'disproportion':133C 'disrupt':152C 'downstream':153C 'echo':38B 'entri':199C 'error':6A,45B,56B,94C,101C,116C,135C,181C,194C,206C,216C 'error-respons':205C 'everi':43B 'extra':61B 'fix':171C,203C,220C 'format':65B,137C,188C 'full':39B,105C 'generat':114C 'ghsa':9A,14A 'ghsa-mwgq':8A,13A 'github.com':169C,227C 'github.com/vllm-project/vllm/issues/49239).':168C 'github.com/vllm-project/vllm/pull/54684.':226C 'handler':7A,90C,174C 'hclsys':79C 'host':28B 'http':47B,97C 'impact':126C 'includ':103C 'initi':209C 'input':41B,107C,121C,185C 'introduc':224C 'issu':166C 'larg':68B,134C 'limit':176C 'llm':23B 'llm-serv':22B 'make':57B 'malform':52B,111C 'mani':55B,115C,198C 'memori':64B,144C 'mwgq':10A,15A 'normal':75C 'number':178C 'occur':218C 'offend':40B,106C 'omit':201C 'openai':4A,32B,83C 'openai-compat':31B,82C 'origin':158C 'overs':184C 'post':163C 'produc':54B 'proxi':156C 'pull':76C 'pydant':100C 'python':25B 'render':91C,180C,208C 'repeat':125C 'report':72C,159C,191C 'request':53B,77C,112C,210C 'requestvalidationerror':89C 'respons':1A,49B,69B,99C,136C,207C 'rmonsur':157C 'sanit':139C 'self':27B 'self-host':26B 'serial':124C 'serv':24B 'server':35B,59B,86C,147C 'share':88C,173C 'singl':51B,110C 'spend':60B 'still':190C,217C 'summar':183C 'summari':80C 'tool':21B 'total':193C 'trigger':131C 'valid':5A,44B,93C,211C,215C 'valu':186C 'vllm':18A,29B,37B 'w2vf':12A,17A","nicknames":[],"mitigations":[],"who_affected":"Teams running the vLLM OpenAI-compatible API server at versions from 0.3.0 up to but not including 0.30.0 are exposed, especially if clients outside their control can send requests to it. Deployments that only serve trusted internal callers are lower risk, and the fix is only in the shared validation error handler, so other endpoints are not described as affected by this text.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["vllm"],"ptokens":["vllm"],"labels":["aitooling","llmserving","medium","pypi","python","selfhosted","vllm"],"campaign_type":null,"search_a":"'9582':11A,16A 'amplif':2A 'error':6A 'ghsa':9A,14A 'ghsa-mwgq':8A,13A 'handler':7A 'mwgq':10A,15A 'openai':4A 'respons':1A 'valid':5A 'vllm':18A 'w2vf':12A,17A","search_b":"'400':48B 'ai':20B 'ai-tool':19B 'api':34B 'compat':33B 'cpu':62B 'echo':38B 'error':45B,56B 'everi':43B 'extra':61B 'format':65B 'full':39B 'host':28B 'http':47B 'input':41B 'larg':68B 'llm':23B 'llm-serv':22B 'make':57B 'malform':52B 'mani':55B 'memori':64B 'offend':40B 'openai':32B 'openai-compat':31B 'produc':54B 'python':25B 'request':53B 'respons':49B,69B 'self':27B 'self-host':26B 'serv':24B 'server':35B,59B 'singl':51B 'spend':60B 'tool':21B 'valid':44B 'vllm':29B,37B","search_c":"'/v1/responses':164C '/vllm-project/vllm/issues/49239).':170C '/vllm-project/vllm/pull/54684.':228C '400':98C '49239':167C 'api':85C,128C 'behavior':161C 'bound':204C 'buffer':149C 'caus':118C 'client':129C,154C 'collect':213C 'compat':84C 'consum':141C 'count':195C 'cpu':142C 'disproportion':133C 'disrupt':152C 'downstream':153C 'entri':199C 'error':94C,101C,116C,135C,181C,194C,206C,216C 'error-respons':205C 'fix':171C,203C,220C 'format':137C,188C 'full':105C 'generat':114C 'github.com':169C,227C 'github.com/vllm-project/vllm/issues/49239).':168C 'github.com/vllm-project/vllm/pull/54684.':226C 'handler':90C,174C 'hclsys':79C 'http':97C 'impact':126C 'includ':103C 'initi':209C 'input':107C,121C,185C 'introduc':224C 'issu':166C 'larg':134C 'limit':176C 'malform':111C 'mani':115C,198C 'memori':144C 'normal':75C 'number':178C 'occur':218C 'offend':106C 'omit':201C 'openai':83C 'openai-compat':82C 'origin':158C 'overs':184C 'post':163C 'proxi':156C 'pull':76C 'pydant':100C 'render':91C,180C,208C 'repeat':125C 'report':72C,159C,191C 'request':77C,112C,210C 'requestvalidationerror':89C 'respons':99C,136C,207C 'rmonsur':157C 'sanit':139C 'serial':124C 'server':86C,147C 'share':88C,173C 'singl':110C 'still':190C,217C 'summar':183C 'summari':80C 'total':193C 'trigger':131C 'valid':93C,211C,215C 'valu':186C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-07T08:04:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-mwgq-9582-w2vf","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-mwgq-9582-w2vf","severity":"medium","published_at":"2026-11-07T08:04:02+00:00","modified_at":"2026-11-07T08:04:02+00:00","first_seen_at":"2026-11-09T22:53:23+00:00","fetched_at":"2026-11-09T22:53:23+00:00","note":null}],"documents":[{"id":110578,"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-mwgq-9582-w2vf","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}