Description

vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When min_tokens > 0, the stop token ids are used as logits indices to suppress stop tokens, so an out-of-range id reaches a CUDA indexing operation (index_put_) and triggers a device-side assertion. An authenticated API user can send a single malformed completion request that returns 500 Internal Server Error and puts EngineCore into a fatal state, causing subsequent requests to fail until the service is restarted (denial of service).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-26T14:16:48.100Z",
  "pubdate": "2026-09-26T14:16:48.100Z",
  "executiveSummary": "vLLM versions prior to 0.29.0 are susceptible to a Denial of Service (DoS) vulnerability triggered by improper validation of user-supplied input.\nThe vulnerability exists within the OpenAI-compatible API endpoints (/v1/completions and /v1/chat/completions), where the 'stop_token_ids' parameter fails to verify that provided identifiers reside within the valid vocabulary range of the loaded model.\nBy submitting an out-of-range token ID, an authenticated API user can force a device-side assertion error during a CUDA indexing operation (index_put_).\nThis crash propagates to the EngineCore, rendering the service non-responsive and necessitating a full manual restart to recover functionality.\nThe flaw allows an attacker to disrupt availability by sending a single, malformed, low-privilege request, representing a significant risk to the stability of production inference environments.",
  "technicalDetails": "The root cause of this vulnerability is the absence of bounds checking on user-controlled input in the 'stop_token_ids' field within the vLLM request handling pipeline. While the system validates that the provided inputs are of an integer type, it fails to perform a comparison against the model's configured vocabulary size or maximum logits index.\nDuring the processing of a completion request where 'min_tokens > 0', the engine is required to suppress specific stop tokens. The provided 'stop_token_ids' are passed directly into a CUDA-accelerated index_put_ operation. Because the application logic does not sanitize these indices, an attacker can supply an integer value that exceeds the allocated memory range for the logits tensor.\nWhen the CUDA kernel attempts to perform an index_put_ operation with an out-of-bounds index, the GPU runtime triggers a device-side assertion. This assertion causes the asynchronous compute stream to abort, leading to an unrecoverable failure of the EngineCore state. Because the EngineCore maintains persistent state for the lifetime of the process, this error transitions the service into a fatal, locked state, resulting in a persistent Denial of Service.\nThe attack flow is straightforward: 1) The attacker initiates an authenticated session with the vLLM instance. 2) The attacker submits a POST request to either /v1/completions or /v1/chat/completions. 3) The request includes a malformed 'stop_token_ids' array containing at least one integer value significantly larger than the model's vocabulary size. 4) The request parameter 'min_tokens' is set to a value greater than 0 to ensure the vulnerable code path is executed. 5) The vLLM backend attempts to apply the invalid stop token constraints via CUDA operations. 6) The GPU device-side assertion triggers a runtime exception, crashing the inference engine process. 7) Subsequent valid requests fail as the EngineCore becomes permanently blocked, preventing further model serving until the service process is restarted."
}