---
id: "GHSA-mwgq-9582-w2vf"
page: "https://infrastack.ai/live/GHSA-mwgq-9582-w2vf"
kind: "vulnerability"
aliases: ["GHSA-mwgq-9582-w2vf"]
title: "Response amplification in OpenAI validation error handler"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "vllm", "fixed": ["0.30.0"], "affected": ">= 0.3.0, < 0.30.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-tooling", "llm-serving", "python", "self-hosted", "vllm"]
not_affected_if: ["no-public-api-access", "version-0.30.0-or-later"]
published_at: "2026-11-07T08:04:02+00:00"
first_seen_at: "2026-11-09T22:53:23+00:00"
updated_at: "2026-11-09T22:56:25+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-mwgq-9582-w2vf", "first_seen_at": "2026-11-09T22:53:23+00:00"}]
exploit_sources: []
---

# Response amplification in OpenAI validation error handler

Link for people: https://infrastack.ai/live/GHSA-mwgq-9582-w2vf (this .md is for agents)

The OpenAI-compatible API server in vLLM echoed full offending input into every validation error in HTTP 400 responses. A single malformed request producing many errors makes the server spend extra CPU and memory formatting a very large response.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:vllm affected >= 0.3.0, < 0.30.0 fixed 0.30.0

## How to check

- Check the installed vLLM version with `pip show vllm` and compare it to the affected range (>= 0.3.0, < 0.30.0)
- Look for the OpenAI-compatible server (`vllm serve`) exposed to clients you do not fully trust
- Confirm the running version with the `version` field of the server's responses or the process's package version

## Fix

- `vllm` `0.30.0` (fixed version per the product data; the fix limits rendered errors and summarizes oversized input values)

## Timeline

- 2026-11-09T22:53:23+00:00 ghsa-repo https://github.com/vllm-project/vllm/security/advisories/GHSA-mwgq-9582-w2vf

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/vllm-project/vllm/security/advisories/GHSA-mwgq-9582-w2vf

## From the sources

This was reported as a normal pull request by @hclsys.

## Summary

The OpenAI-compatible API server's shared `RequestValidationError` handler rendered all validation errors in its HTTP 400 response. Pydantic errors can include the full offending input, so a single malformed request that generates many errors can cause the same input to be serialized repeatedly.

## Impact

An API client can trigger a disproportionately large error response. Formatting and sanitizing it consumes CPU and memory on the server, and buffering it can disrupt downstream clients and proxies. @rmonsurate originally reported the behavior on `POST /v1/responses` in [issue #49239](https://github.com/vllm-project/vllm/issues/49239).

## Fix

The shared handler now limits the number of rendered errors and summarizes oversized input values before formatting. It still reports the total error count and how many entries were omitted. The fix bounds error-response rendering. Initial request validation and collection of validation errors still occur.

A fix for this was introduced in https://github.com/vllm-project/vllm/pull/54684.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_