CVE-2025-29770: Vllm Vllm Cache Exhaustion DoS Vulnerability

CVE-2025-29770 Overview

CVE-2025-29770 is a denial of service vulnerability in vLLM, a high-throughput inference and serving engine for large language models (LLMs). The flaw resides in the outlines backend used for structured output (guided decoding), which vLLM enables by default through its OpenAI-compatible API server. The outlines library writes compiled grammars to a local filesystem cache without any bound, allowing an authenticated attacker to exhaust disk space. The vulnerability is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling]. It affects the V0 engine and is fixed in vLLM version 0.8.0.

Critical Impact
A malicious user can send crafted decoding requests with unique schemas to fill the filesystem, causing denial of service for the inference server and any co-located workloads.

Affected Products

vLLM V0 engine (all versions prior to 0.8.0)
Deployments exposing the OpenAI-compatible API server
Any configuration where the outlines guided decoding backend is reachable per-request via guided_decoding_backend

Discovery Timeline

2025-03-19 - CVE-2025-29770 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29770

Vulnerability Analysis

vLLM integrates the outlines library to support guided decoding, which constrains model output to a schema such as JSON or a regular expression. Compiling these schemas is expensive, so outlines caches the compiled artifacts on disk. The vLLM implementation in vllm/model_executor/guided_decoding/outlines_logits_processors.py enables this cache unconditionally, with no size cap, eviction policy, or request-level limit.

Each unique schema submitted by a client produces a new cache entry. An attacker can generate an unlimited number of distinct schemas and issue short decoding requests to force cache growth. The behavior falls under [CWE-770] because the server allocates disk resources tied to attacker-controlled input.

The impact extends beyond the vLLM process. When the underlying filesystem runs out of space, other services on the same volume — logging, model weights, container runtimes — can fail. Confidentiality and integrity are unaffected, but availability is compromised.

Root Cause

The root cause is the unconditional use of the outlines on-disk cache inside outlines_logits_processors.py. vLLM neither disables the cache nor enforces bounds on the number of cached grammars or the disk footprint. Because outlines is selectable per-request through the guided_decoding_backend key in extra_body, switching the default backend does not mitigate the issue.

Attack Vector

An authenticated client sends a stream of short completion or chat requests to the OpenAI-compatible endpoint. Each request specifies guided decoding with a unique JSON schema or regex pattern. The server compiles and caches each grammar, consuming disk space until the volume is exhausted and the service degrades or crashes.

See the GitHub Security Advisory GHSA-mgrm-fgjv-mhv8 and the vulnerable code in outlines_logits_processors.py for the affected implementation.

Detection Methods for CVE-2025-29770

Indicators of Compromise

Rapid growth of the outlines cache directory on the vLLM host, typically under the user's cache path.
High-frequency API requests from a single client containing distinct guided_json, guided_regex, or guided_grammar values.
Filesystem free-space alerts on the volume backing the vLLM process.
Requests explicitly setting extra_body.guided_decoding_backend to outlines when a different backend is the configured default.

Detection Strategies

Instrument the vLLM API layer to log the schema hash for each guided decoding request and alert on high cardinality per client or API key.
Monitor inode and disk usage on the volume storing model and cache data, with thresholds well below capacity.
Correlate 5xx responses and pod restarts with disk-pressure events in the container runtime.

Monitoring Recommendations

Track request rate and payload uniqueness on /v1/completions and /v1/chat/completions endpoints.
Emit metrics for the size and file count of the outlines cache directory.
Enable audit logging on API tokens that can reach the inference endpoint to attribute anomalous behavior to a specific principal.

How to Mitigate CVE-2025-29770

Immediate Actions Required

Upgrade vLLM to version 0.8.0 or later, where the issue is fixed.
Restrict access to the OpenAI-compatible API to trusted, authenticated clients and apply per-key rate limits.
Isolate the vLLM cache directory on a dedicated volume with a hard size quota to contain resource exhaustion.

Patch Information

The fix is delivered in vLLM 0.8.0 and tracked in vLLM Pull Request #14837. Review the GitHub Security Advisory GHSA-mgrm-fgjv-mhv8 for the full remediation notes and affected commit range.

Workarounds

Migrate workloads to the vLLM V1 engine, which is not affected.
Block or reject requests that set guided_decoding_backend to outlines at an API gateway if the backend is not required.
Place a reverse proxy in front of vLLM to enforce request quotas and reject high-cardinality schema traffic.
Mount the cache directory on a size-limited tmpfs or dedicated volume so exhaustion cannot impact other services.

bash

# Configuration example: upgrade vLLM and constrain the outlines cache volume
pip install --upgrade 'vllm>=0.8.0'

# Isolate the outlines cache to a size-limited tmpfs mount
mount -t tmpfs -o size=512M tmpfs /var/cache/outlines
export XDG_CACHE_HOME=/var/cache/outlines