EUVD-2026-109442
GHSA-f2x4-7hx3-gxfp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain inference API access (PR:L)
-
DeliveryCraft request with out-of-vocabulary stop_token_ids
-
ExploitSubmit via chat/completion/generate/batch endpoint
-
ExecutionInvalid ID used as logits column index
-
PersistEngine assert crash (V1) or OOB GPU write (V2)
-
ImpactService denial for all users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Array index validation
|
| Exploitation Conditions | Exploitation requires the attacker to be able to submit generation requests to the vLLM server through one of the affected request paths - OpenAI chat, OpenAI completion, the legacy generate endpoint, or batch inputs - and to include a stop_token_ids value that is a valid integer but outside the loaded model's vocabulary range (pre-fix, only integer type was checked, not vocabulary bounds). The CVSS PR:L indicates this access is a privileged/authenticated capability rather than fully anonymous, which is the primary limiting factor. The out-of-bounds GPU write specifically requires the V2 runner; the default V1 runner instead asserts and crashes the engine. All affected versions are >= 0.20.1 and < 0.29.0; upgrading to 0.29.0 (which validates every stop_token_ids value against the model vocabulary) removes the condition. |
| Impact | This is a genuine but bounded operational risk, not a hair-on-fire emergency. The VulnCheck-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) tells a consistent story: network-reachable, low attack complexity, no user interaction, but requiring low-level privileges (PR:L) - i.e. an actor who can already submit inference requests to the API - with impact confined to availability (VA:H), no confidentiality or integrity loss claimed. The vuln.today priority is 'this_week' rather than act_now/emergency, which aligns with a high-severity availability bug that is trivial to trigger but needs request-submission access. Signal gaps to be explicit about: the input provides NO EPSS score and NO KEV listing, and there is no confirmed public exploit code - so there is no evidence of active or widespread exploitation, and real-world probability cannot be quantified from this data. One caveat worth flagging: the GHSA advisory describes a V2-runner out-of-bounds GPU write (CWE-787) that corrupts adjacent logits/GPU state, which could plausibly cross into an integrity concern, yet the supplied vector rates VI:N and treats the issue as availability-only - verify the real impact of the OOB write with the vendor before downgrading integrity risk. Net: real priority to patch promptly for anyone exposing vLLM to semi-trusted or multi-tenant request traffic, but the PR:L requirement meaningfully limits blast radius versus a fully unauthenticated flaw. |
| Exploit ScenarioDerived | An actor with the ability to send inference requests (e.g. a tenant on a shared vLLM endpoint or a user who has reached the API) submits an OpenAI chat, completion, legacy generate, or batch request containing a stop_token_ids value outside the model's vocabulary. On the default V1 runner this triggers a device-side index assertion that terminates the engine, denying service to all other users; on the V2 runner the same unchecked index becomes an out-of-bounds Triton store that writes past the logits buffer. No public exploit code is identified in the provided data, though the issue was confirmed by the reporter on vLLM 0.20.1. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 25, 2026
Out-of-vocabulary stop_token_ids in vLLM 0.20.1 through 0.28.x allow a client able to submit generation requests to terminate the inference engine, causing denial of service for every other user sharing that server; on the V2 runner the same unchecked index can instead write outside the logits buffer and corrupt adjacent logits or other GPU state. The flaw is an input-validation gap: SamplingParams accepted any integer for stop_token_ids and those values became column indices into the model's logits tensor, so the OpenAI chat and completion paths, the legacy generate endpoint, and batch inputs are all affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H) puts this at 7.1 with availability-only impact, and the PR:L metric is the main limiting factor, meaning the attacker needs the privileged capability to submit requests rather than being fully anonymous; no public exploit code or active exploitation has been identified at time of analysis, and priority is this-week remediation rather than emergency response.
RemediationAI
Upgrade the vllm package to 0.29.0 or later, the first release containing the validation fix from PR #54196, which rejects any stop_token_ids value outside the loaded model's vocabulary as a request error before it reaches the sampler; the vendor advisory GHSA-w9r6-29q4-pvpr documents the fix and VulnCheck's advisory records the same vulnerable-to-fixed range (>= 0.20.1, < 0.29.0). The available sources do not describe a configuration-level workaround that removes the condition without upgrading, so plan the version bump rather than relying on a setting change. Because the assessed vector carries PR:L, the practical exposure is bounded by who can reach the generation endpoints, so until the upgrade lands, restrict submission of chat, completion, generate and batch requests to trusted clients and treat any engine-level assertion or GPU fault following an unusual stop_token_ids value as a possible trigger event; note that restricting these endpoints limits the service's intended function and does not fix the underlying indexing gap, which only 0.29.0 does.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vLLM is a high-throughput LLM inference and serving engine that exposes OpenAI-compatible chat and completion APIs plus a legacy generate endpoint and batch processing. Per-request sampling behaviour is configured through SamplingParams, which carries stop_token_ids - token IDs at which generation should halt. Those IDs are used as column indices into the model's logits tensor, so they must lie inside the loaded model's vocabulary. Pre-fix, the only check was that each value was an integer; vocabulary bounds were never validated, which is the classic CWE-129 improper validation of array index pattern, with the advisory additionally classifying the outcome as CWE-248 (uncaught exception), CWE-400 (uncontrolled resource consumption) and CWE-787 (out-of-bounds write). The execution path determines the consequence: on the default V1 runner an out-of-range index trips a device-side index error and an assertion that terminates the engine, while on the V2 runner the invalid index reaches a Triton store that writes past the end of the logits buffer, potentially corrupting adjacent logits or other GPU state. The advisory confirms reproduction on vLLM 0.20.1 and states that validation first shipped in v0.29.0 via PR #54196, which checks every stop_token_ids value against the model vocabulary before it reaches the sampler and rejects invalid IDs as ordinary request errors.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Reachable over the network with low complexity and no UI, but needs request-submission privilege (PR:L); impact is engine crash/DoS so A:H with C:N/I:N, matching the vendor vector.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or write outside the V2 runner's logits buffer.
Technical POC Analysis
Source evidence: GHSA-w9r6-29q4-pvpr (vllm-project/vllm).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity denial-of-service vulnerability in vLLM versions 0.20.1 through 0.28.x allows any user with the ability to submit generation requests to crash the inference engine, disrupting all other users on the same server; on the V2 runner, it can also corrupt GPU state, potentially causing further instability. Because vLLM often serves multiple teams or applications, a single malicious or malformed request could take down shared AI services, impacting productivity and trust in the platform.
No vendor-released patch identified at time of analysis; interim mitigations include restricting access to trusted users, implementing input validation to reject out-of-vocabulary stop_token_ids, and monitoring for anomalous requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB