Executive brief
vLLM is a high-throughput inference engine for large language models. A malformed tiktoken vocabulary file with duplicate token ranks can cause the TiktokenTokenizer initialization to panic, crashing the service. This affects only systems with local access to inject or modify vocabulary files.
Technical details
The vulnerability is a denial-of-service condition in the TiktokenTokenizer::new() function in rust/src/text/src/backend/hf/mod.rs. When a tiktoken vocab file assigns the same rank to multiple tokens, the library asserts instead of properly returning an error, causing a panic. The attack requires local file system access to craft or modify a malicious vocab file. An attacker with local access can trigger this crash by loading a specially crafted vocabulary file, disrupting vLLM inference services. A fix is pending acceptance in the project's pull request queue.
Affected products
- vLLM Project vLLM up to 0.29.0
Timeline
- 2026-09-14: disclosed
- other: Exploit proof-of-concept released publicly