Executive brief
vLLM is an open-source language model serving platform used to deploy and query AI models. Versions 0.22.0 through 0.23.0 fail to validate user-supplied stop token IDs in the Rust HTTP and gRPC interfaces, allowing attackers to submit malformed requests that crash the core inference engine and require a full service restart. This is a denial-of-service attack requiring no authentication on exposed endpoints.
Technical details
The vulnerability is an input validation bypass where out-of-vocabulary token IDs in stop_token_ids parameters bypass Rust-side bounds checking and reach the Python MinTokensLogitsProcessor, which uses them as direct CUDA tensor indices without validation. When min_tokens is greater than zero, the out-of-range token ID triggers a device-side assertion in logits.index_put_, leaving EngineCore in an unrecoverable state. The Python request path was patched in PR #44968 to validate stop_token_ids against [0, vocab_size), but the Rust HTTP OpenAI routes and gRPC frontend paths forward these IDs directly without the same validation, despite validating other token-id fields like prompt and allowed_token_ids.
Affected products
- vLLM Project vLLM 0.22.0 through 0.23.0
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Patched in vLLM v0.24.0 and later