Vulnerability lasts 5 seconds. That length was chosen so that even if your reflexes are pretty sluggish, you can probably get in one attack before it ends. If you have good reflexes, you can reliably get two attacks in. (And you can sometimes get three attacks in, but not reliably.)