vLLM: VLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in…
vLLM
More for vLLM RSS feed for vLLM
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Record
- CVE-2026-100652
- Affects
- vLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 26, 2026
- Source last modified
- October 6, 2026
Description
vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids to trigger CUDA tensor indexing failures that leave EngineCore in a fatal state requiring service restart.
Description quoted from the NVD record.
Who is affected
vLLM is software that runs AI language models on your own servers so other apps can send them questions and get answers. This flaw affects vLLM versions 0.22.0 through 0.23.0. The parts of vLLM that receive incoming requests do not check whether certain stop markers in a request are valid for the model. An attacker who can send requests to your vLLM server can craft one that crashes the main engine, which stops the service until someone restarts it. This flaw is rated High.
What to do
- If someone in your organization installed or runs vLLM, ask them to check which version is in use. If it is 0.22.0 through 0.23.0, this flaw applies.
- No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release and install it as soon as one is available.
- If an IT provider or vendor runs vLLM for your organization, send them this advisory and ask when the update will be done.
- Until vLLM is updated, if the service stops responding, the person who runs it will need to restart it to bring it back.
Analysis written from the source record as of October 6, 2026 and reviewed before publishing.