CVE-2026-115916: vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it, causing a CUDA device-side assertion and terminating the engine. This issue is fixed in version 0.32.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vLLMto a version that resolves this vulnerability.Fixed in 0.32.0
Event History
Frequently Asked Questions
Which deployments are affected by the crash condition?
The described CUDA device-side assertion requires tensor-parallel size one and a model vocabulary size that is an exact multiple of 64. Affected deployments must also accept a pre-tokenized prompt ID equal to the vocabulary size.
What access does an attacker need to trigger the denial of service?
An attacker needs privileges to submit a pre-tokenized prompt to the vLLM engine. No user interaction is required, and the supplied token ID must be equal to the vocabulary size.
What versions should be remediated?
vLLM versions before 0.32.0 are affected. Upgrade to version 0.32.0, which fixes the validation issue.