EUVD-2026-110036
GHSA-q97c-p368-75c4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vLLM inference endpoint accepting token ids
-
DeliveryCraft pre-tokenized prompt with id equal to vocab size
-
ExploitBypass off-by-one input-id validation
-
ExecutionUnmasked out-of-range F.embedding lookup (tp=1)
-
ImpactCUDA device-side assert crashes engine (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Array index validation
|
| Exploitation Conditions | Exploitation requires ALL of: (1) the attacker can submit pre-tokenized input to the server via /v1/completions with prompt given as token ids, a /tokenize-fed flow, or the kv_transfer_params["prompt_token_ids"] reuse path; (2) the model is served at tensor-parallel size 1 - at tp>1 VocabParallelEmbedding masks indices via get_masked_input_and_mask, so the id is clamped (possibly wrong output) rather than crashing; and (3) the model's vocabulary is an exact multiple of the 64-row embedding padding size with tokenizer.vocab_size one past the largest real id, which gives zero padding headroom - Llama-2-family models (vocab 32000) are the clear case, whereas Qwen2.5 is NOT affected because it has padded headroom. The specific malicious value is a single token id equal to the vocabulary size. CVSS PR:L indicates a caller with at least low-privilege API access is required; these deployment prerequisites, not raw network reach, are the real limiting factors. |
| Impact | Signals are moderate and internally consistent. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H scores 6.5 (MEDIUM): network-reachable, low attack complexity, low privilege (PR:L indicates an authenticated/API-level caller), availability-only impact with no confidentiality or integrity loss - matching a pure denial-of-service that crashes the engine but exposes no data. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a DoS rather than RCE. This is NOT in CISA KEV (no confirmed active exploitation), and no EPSS score was supplied, so exploitation probability cannot be quantified from the input - state this gap explicitly. No public exploit is referenced (only the advisory, fix PR, fix commit, and release are linked), though GHSA-q97c-p368-75c4 documents the trigger in full detail, lowering the bar for an attacker to reproduce it. Net: a legitimate MEDIUM-severity availability issue, meaningful for anyone exposing a vLLM endpoint that accepts pre-tokenized input, but gated by specific deployment conditions (tensor-parallel size 1 AND a model whose vocabulary is an exact multiple of 64 such as the Llama-2 family) - not a broad, unauthenticated, high-urgency emergency. |
| Exploit ScenarioDerived | A client able to reach a vLLM inference API that accepts pre-tokenized input (e.g. /v1/completions with prompt supplied as token ids, /tokenize-fed flows, or the kv_transfer_params["prompt_token_ids"] reuse path) sends a single request containing a token id equal to the vocabulary size (e.g. 32000 on a Llama-2 model at tensor-parallel size 1). The id slips past vLLM's off-by-one input validation and reaches F.embedding out of range, raising a CUDA device-side assert that poisons the CUDA context and takes the serving engine down. No public PoC is referenced, but the GHSA advisory describes the exact trigger. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Out-of-vocabulary token IDs slip past vLLM's prompt validation and can crash the inference engine, turning a single malformed request into a denial of service. Releases prior to 0.32.0 derive max_token_id from the tokenizer's vocabulary count rather than the largest valid index, so a pre-tokenized prompt carrying the ID equal to the vocabulary size is accepted and reaches the embedding lookup one row out of range, raising a CUDA device-side assert that poisons the context and terminates the engine. The crash is confined to models whose vocabulary is an exact multiple of the 64-row embedding padding size (Llama-2-family, vocab 32000) served at tensor-parallel size 1; the assessed CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting that low-privilege API access is needed and that availability is the only impacted property, and no public exploit was identified at time of analysis.
RemediationAI
Upgrade to vLLM 0.32.0, the release that corrects the bound in get_cached_tokenizer so max_token_id becomes max(max(vocab.values()), tokenizer.vocab_size - 1); the fix landed in pull request https://github.com/vllm-project/vllm/pull/59491 (commit 37cecc8141e2dcba9dd534897a164d4baaf27229) and shipped in https://github.com/vllm-project/vllm/releases/tag/v0.32.0, with the advisory at https://github.com/vllm-project/vllm/security/advisories/GHSA-q97c-p368-75c4. If an upgrade cannot be scheduled immediately, the trigger conditions themselves define the controls: restrict or disable untrusted submission of pre-tokenized prompts through /v1/completions with prompt given as token IDs, /tokenize-fed flows, and the kv_transfer_params["prompt_token_ids"] reuse path, or add front-end validation that rejects any token ID greater than the tokenizer's largest real ID - the trade-off is loss of client-side tokenization and prompt-reuse functionality for callers that rely on those paths. Serving the affected models at tensor-parallel size greater than 1 avoids the device-side assert because the embedding lookup masks indices, but the advisory indicates that case yields possibly incorrect output rather than a guarantee of safety, so it should not be treated as equivalent to patching. No patch workaround is documented beyond updating to 0.32.0.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is an improper-validation-of-array-index (CWE-129) with an off-by-one (CWE-193) root cause inside vLLM's cached Hugging Face tokenizer wrapper. vllm/tokenizers/hf.py sets max_token_id = max(max(vocab.values()), tokenizer.vocab_size); because tokenizer.vocab_size is a count, this can exceed the largest real ID by one - for Llama-2 tokenizers max(vocab.values()) is 31999 while vocab_size is 32000. vllm/v1/engine/input_processor.py then validates IDs against max(tokenizer.max_token_id, model_config.get_vocab_size() - 1), which resolves to 32000 and admits an index that the embedding matrix, padded with pad_vocab_size(32000, 64) to exactly 32000 rows (valid indices 0..31999), cannot represent. At tensor-parallel size 1, VocabParallelEmbedding.forward performs no index masking before F.embedding, so the out-of-range index triggers a CUDA device-side assert; at tensor-parallel size >1 get_masked_input_and_mask clamps the value instead, which the advisory characterizes as likely incorrect output rather than a crash. Models with padding headroom (Qwen2.5 is named as not affected) absorb the extra index harmlessly. CPE data maps the affected package broadly as cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*, with the fixed branch being 0.32.0.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable API caller sends one crafted token id (AC:L); PR:L because an inference endpoint accepting pre-tokenized input is required; engine crash gives A:H with no C/I impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it, causing a CUDA device-side assertion and terminating the engine. This issue is fixed in version 0.32.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB