Executive brief
vLLM is a widely used inference engine that serves language model embedding and pooling tasks via REST API. Versions before 0.28.0 fail to validate that token IDs are non-negative, allowing an unauthenticated attacker to send a single malicious request that crashes the entire service and makes it unresponsive until manually restarted. This causes a complete denial of service for all users of the service.
Technical details
The vulnerability is an improper input validation (CWE-129) affecting the /v1/embeddings and /pooling endpoints. The InputProcessor._validate_model_input function checked only the upper bound of token IDs against the vocabulary size but failed to validate the lower bound, allowing negative token IDs to pass through to the GPU. When a negative ID is used as an array index in PyTorch's GPU indexing kernel, it triggers an unhandled CUDA device-side assertion that poisons the GPU context. This is not a catchable Python exception; after the assertion fires, all subsequent CUDA operations in the process fail, causing the entire service to become unresponsive. The attack requires no authentication and can be triggered by a single HTTP POST request with input such as [[-1, 1879]]. The fix (released in 0.28.0) adds a lower-bound check to reject negative IDs with HTTP 400 before they reach the GPU.
Affected products
- vLLM vLLM < 0.28.0
Timeline
- 2026-09-18: disclosed
- 2026-09-03: patched: Fix released in version 0.28.0