Description

vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids to trigger CUDA tensor indexing failures that leave EngineCore in a fatal state requiring service restart.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-26T14:16:47.810Z",
  "pubdate": "2026-09-26T14:16:47.810Z",
  "executiveSummary": "The vulnerability involves an improper input validation flaw within vLLM versions 0.22.0 through 0.23.0. Specifically, the Rust-based HTTP and gRPC frontends fail to enforce boundary checks on 'stop_token_ids' against the model's vocabulary size.\nBy submitting maliciously crafted requests containing out-of-vocabulary token IDs in conjunction with 'min_tokens' parameters greater than zero, an attacker can trigger an unhandled exception within the MinTokensLogitsProcessor.\nThis condition leads to a CUDA tensor indexing failure, which propagates to the EngineCore. The result is a fatal engine state that requires a manual service restart to recover, thereby constituting a Denial-of-Service (DoS) condition.\nThe vulnerability affects systems utilizing the specified versions of vLLM that expose HTTP or gRPC interfaces to external or untrusted users. There is no requirement for specific authentication or elevated privileges to initiate the attack, as the payload is processed during standard inference request handling. The risk is significant for high-availability environments where service uptime is critical.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input sanitization of the 'stop_token_ids' parameter within the vLLM frontend implementation (Rust-based HTTP and gRPC layers). The application logic accepts user-defined token identifiers without validating them against the constrained index range of the model's vocabulary.\nWhen a request is submitted, these unchecked identifiers are passed downstream to the 'MinTokensLogitsProcessor'. Because the logic assumes that all received tokens are valid indices within the model's tensor space, it proceeds to perform tensor operations using these out-of-bounds integers.\nThe exploitation flow initiates when an attacker transmits a request with 'min_tokens > 0' and includes arbitrary integer values in the 'stop_token_ids' list that exceed the bounds defined by the underlying model's vocab_size. Upon processing the 'min_tokens' constraint, the processor attempts to apply these indices to a CUDA tensor.\nThe CUDA kernel or the associated PyTorch/LibTorch binding detects an index out-of-bounds error during the operation. This violation causes a runtime exception that is not gracefully handled by the inference engine's execution loop.\nThe resulting failure crashes the 'EngineCore'. Because the 'EngineCore' is a stateful component managing the model's persistent execution context, the crash forces the entire vLLM process into a fatal, non-recoverable state. Subsequent requests cannot be processed, and the orchestration layer (e.g., Kubernetes or systemd) must perform a hard restart of the process to restore functionality.\nThis vulnerability is effective regardless of the model type, provided the frontend fails to validate the tokens against the specific vocabulary metadata of the loaded model. As the input is ingested directly through the API, it is accessible to any entity capable of communicating with the vLLM server over HTTP or gRPC."
}