CVE-2024-11040

Summary

CVE-2024-11040 affects the vllm-project v0.5.2.2, making it susceptible to Denial of Service (DoS) attacks. In the 'POST /v1/completions' endpoint, enabling 'use_beam_search' and setting 'best_of' to a high value can lead to an HTTP connection timeout, causing vllm to cease functioning effectively and keeping new completion requests in a 'pending' state. In the 'POST /v1/embeddings' endpoint, providing invalid JSON inputs instigates an issue in the background loop, resulting in all subsequent completion requests returning a 500 HTTP error code until vllm is restarted.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.