CVE-2026-100654: vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids
vLLM before 0.29.0 accepts user-controlled stoptokenids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When mintokens > 0, the stop token ids are used as logits indices to suppress stop tokens, so an out-of-range id reaches a CUDA indexing operation (indexput) and triggers a device-side assertion. An authenticated API user can send a single malformed completion request that returns 500 Internal Server Error and puts EngineCore into a fatal state, causing subsequent requests to fail until the service is restarted (denial of service).
Affected Software
Event History
Frequently Asked Questions
Who can trigger the denial of service?
An authenticated API user who can submit requests to the OpenAI-compatible /v1/completions or /v1/chat/completions endpoints can trigger it. No user interaction is required.
What request conditions are needed to exploit the issue?
The request must include user-controlled stop_token_ids containing an integer outside the model vocabulary or logits range, with min_tokens set to a value greater than 0. A single malformed completion request can trigger the failure.
Are deployments affected by default?
The issue is reachable through the OpenAI-compatible completion endpoints when callers can supply stop_token_ids and min_tokens greater than 0. The provided information does not establish whether these request parameters are used in a particular deployment's default workload or configuration.
How can I recognize an attempted or successful exploitation?
A triggering request returns HTTP 500 Internal Server Error and causes a CUDA device-side assertion in index_put_. EngineCore then enters a fatal state, and subsequent requests fail until the service is restarted.
What can be done if patching is not immediately possible?
Restrict access to the affected endpoints to trusted authenticated users and reject or filter stop_token_ids that are outside the model vocabulary or logits range, particularly when min_tokens is greater than 0. Restart the service if EngineCore has entered the fatal state.