CVE-2026-100652: vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids
vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to trigger CUDA tensor indexing failures that leave EngineCore in a fatal state requiring service restart.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running vLLM versions 0.22.0 through 0.23.0 are affected when they use the Rust HTTP or gRPC frontends. The issue is reachable over the network and does not require authentication or user interaction.
What does an attacker need to send to trigger the denial of service?
An attacker must submit a request with min_tokens greater than zero and stop_token_ids containing token IDs outside the model vocabulary bounds. This causes CUDA tensor indexing failures in MinTokensLogitsProcessor.
What is the operational impact after successful exploitation?
EngineCore enters a fatal state and the service requires a restart to recover. The provided data indicates availability impact only, with no confidentiality or integrity impact.