Description

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests to return incorrect tokens.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-19T23:17:10.043Z",
  "pubdate": "2026-09-19T23:17:10.043Z",
  "executiveSummary": "vLLM versions up to 0.29.0 are susceptible to a memory corruption vulnerability within the SamplingParams.update_from_tokenizer() function. The vulnerability stems from improper validation of bad_words token indices provided during inference requests.\nBy submitting maliciously crafted token indices that exceed the boundaries of the model's generation output width, an attacker can induce out-of-bounds memory access. This flaw results in the corruption of logits memory utilized by concurrent inference requests.\nThe primary impact is a severe breakdown of request isolation, allowing the logits of one user's request to be influenced or contaminated by the token state of another. This leads to the generation of incorrect, unintended, or potentially sensitive tokens across in-flight HTTP requests.\nThis vulnerability poses a significant risk to data integrity and service reliability in multi-tenant environments where a single vLLM instance processes requests from multiple users. Successful exploitation does not require administrative privileges but necessitates the ability to submit inference requests to the API. Immediate patching or input sanitization is required to prevent cross-request state leakage.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input validation performed by SamplingParams.update_from_tokenizer() within the vLLM engine. When an inference request includes a 'bad_words' constraint, the system attempts to process these token indices to prevent the model from generating forbidden sequences. However, the function fails to verify that the provided token indices fall within the valid range defined by the model's vocabulary size and the allocated logits buffer dimensions.\nExploitation occurs when an attacker submits an inference request containing 'bad_words' parameters where one or more token indices are out-of-bounds (OOB). When the vLLM scheduler processes this request, the OOB index is used to calculate memory offsets for logit manipulation. Because the input index is not clamped or rejected, the underlying C++ or CUDA kernels perform read/write operations at unintended memory locations.\nThe attack flow proceeds as follows: First, the attacker identifies a vLLM deployment that exposes an API endpoint accepting 'bad_words' in its SamplingParams. Second, the attacker constructs a payload containing specific OOB token indices that, when processed, target the memory regions reserved for logits of other active, concurrent requests. Third, upon submission, the internal logits buffer—which stores probability distributions for the next token prediction—is corrupted by the out-of-bounds indexing operation.\nThe impact of this corruption is immediate and severe. As the vLLM engine uses the corrupted logits buffer to sample the next token for concurrent requests, the output of those requests becomes nondeterministic and functionally compromised. The model may generate tokens influenced by the attacker's OOB parameters, effectively allowing for the injection of data or the redirection of output streams. In a multi-user environment, this results in the leakage of internal states or the total degradation of response accuracy, as the shared logits memory space is effectively poisoned.\nThis vulnerability represents a critical flaw in the request processing pipeline, as it violates the boundary constraints of the GPU memory management intended to separate individual inference tasks. The lack of bounds checking in the tokenizer update logic allows an attacker to bypass standard input validation, leading to uncontrolled memory access patterns that persist until the memory buffers are cleared or reallocated."
}