EUVD-2026-41921
GHSA-8wr5-jm2h-8r4f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated client crashes the shared worker with legal requests (AV:N/PR:N/AC:L); impact is availability-only DoS, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into the drafter's input ids; that out-of-vocabulary value is later consumed by the model's embedding and attention path and crashes the engine worker with a GPU device-side assertion. The same triggering request sequence is reachable through the public gRPC Generate and Abort endpoints, so a remote client that can send generation requests can crash the shared engine worker, aborting concurrent requests and causing a service-wide denial of service for other clients of the deployment until the worker is restarted. This issue is fixed in version 0.24.0.
AnalysisAI
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the shared engine worker by sending a specific multi-request speculative decoding workload. The rejection sampler produces a recovered token equal to the vocabulary-size boundary, which is coerced to -1, written back into the drafter's input ids, and later dereferenced by the embedding/attention path, triggering a GPU device-side assertion that kills the worker. There is no public exploit identified at time of analysis and this CVE is not in CISA KEV; per CVSS the impact is availability-only (C:N/I:N/A:H) with a low EPSS profile expected for a crash-only bug.
Technical ContextAI
vLLM is a high-throughput, memory-efficient serving engine for large language models, exposing generation to clients over public gRPC endpoints (Generate/Abort). The flaw lives in the speculative decoding path: a drafter model proposes tokens that a rejection sampler accepts or rejects against the target model. The root cause maps to CWE-20 (Improper Input Validation) - the sampler can emit a 'recovered token' equal to vocab_size (an out-of-bounds index into a 0..vocab_size-1 embedding table). When the engine selects the next live token, that boundary value is converted to -1 and fed back into the drafter's input ids; the subsequent embedding lookup and attention computation index out of range on the GPU, and CUDA's device-side assertion aborts the worker process. The affected component is cpe:2.3:a:vllm-project:vllm across all versions before the fix.
RemediationAI
Vendor-released patch: upgrade vLLM to version 0.24.0 or later, which fixes the boundary-token handling in the rejection sampler (advisory GHSA-8wr5-jm2h-8r4f; fix in PR 44744 / commit 8a5cf1ccd65e8ac7635c402c1ec0b08988bc26ca). If immediate upgrade is not possible, the most effective compensating control is to disable speculative decoding on the server, which removes the vulnerable code path entirely at the cost of the throughput/latency gains that feature provides. Additionally, restrict access to the gRPC Generate/Abort endpoints to trusted clients via network ACLs or an authenticating proxy, and place per-client rate limiting in front of the deployment so a single abusive request stream cannot repeatedly crash the shared worker; the trade-off is added infrastructure and the fact that these controls limit but do not eliminate reach for authorized-but-malicious clients. Configure automatic worker restart/supervision to shorten outage windows as a stopgap only, since it does not prevent the crash.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Vllm versions up to 0.12.0 is affected by allocation of resources without limits or throttling (CVSS 6.5).
Race condition in vLLM's prompt embedding loader allows concurrent API requests to bypass the sparse tensor invariant gu
Remote code execution in vLLM 0.10.1 through 0.13.x lets an attacker who controls the model repository or path run arbit
Server-Side Request Forgery in vLLM's multimodal MediaConnector allows remote attackers to coerce the inference server i
Denial of service in vllm 0.19.0's OpenAI-compatible serving path allows remote unauthenticated attackers to exhaust sch
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today