EUVD-2026-41921
GHSA-8wr5-jm2h-8r4f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach exposed gRPC Generate endpoint
-
DeliverySubmit crafted multi-request speculative workload
-
ExploitSampler emits vocab-size boundary token
-
InstallValue coerced to -1 in drafter input ids
-
C2Out-of-vocab embedding/attention lookup
-
ExecuteGPU device-side assertion crashes worker
-
ImpactConcurrent requests aborted, service-wide DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the target vLLM deployment (before 0.24.0) to be running with speculative decoding enabled and to expose the public gRPC Generate and Abort endpoints to the attacker; the attacker then submits a frontend-legal multi-request speculative-decoding workload that steers the rejection sampler to the vocabulary-size boundary token. Per the CVSS vector no authentication is required (PR:N), no user interaction is needed (UI:N), and complexity is low (AC:L). The primary limiting factor is that speculative decoding is a non-default configuration - deployments without it are not exploitable - and the endpoints must be reachable by the attacker; impact is confined to availability (worker crash / service-wide DoS) with no data disclosure or code execution. |
| Impact | Signals are internally consistent and point to a genuine but bounded (availability-only) risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) indicates a remote, unauthenticated, low-complexity crash with no confidentiality or integrity impact - a pure DoS. No KEV listing and no POC are provided, so this is not confirmed exploited and no public exploit code is indicated; EPSS is not supplied but crash-only bugs of this class typically score low, suggesting the near-term real-world exploitation likelihood is modest. The one nuance to verify: the description requires a speculative-decoding-configured deployment, which is a non-default feature - so AC:L may understate the practical requirement that the target server has speculative decoding enabled. Net: legitimate priority for anyone running vLLM with speculative decoding exposed to untrusted clients, lower priority otherwise; the shared-worker blast radius (one request aborts all concurrent tenants) raises impact for multi-tenant deployments. |
| Exploit ScenarioDerived | An attacker with the ability to submit generation requests to a vLLM deployment that has speculative decoding enabled sends a crafted multi-request workload that drives the rejection sampler to emit the vocab_size boundary token. The out-of-vocabulary value is fed back into the model's embedding/attention path and triggers a GPU device-side assertion, crashing the shared engine worker and aborting all concurrent users' requests until the worker restarts. No authentication is required (PR:N) and complexity is low (AC:L); no public POC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 06, 2026
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the shared engine worker by sending a specific multi-request speculative decoding workload. The rejection sampler produces a recovered token equal to the vocabulary-size boundary, which is coerced to -1, written back into the drafter's input ids, and later dereferenced by the embedding/attention path, triggering a GPU device-side assertion that kills the worker. There is no public exploit identified at time of analysis and this CVE is not in CISA KEV; per CVSS the impact is availability-only (C:N/I:N/A:H) with a low EPSS profile expected for a crash-only bug.
RemediationAI
Vendor-released patch: upgrade vLLM to version 0.24.0 or later, which fixes the boundary-token handling in the rejection sampler (advisory GHSA-8wr5-jm2h-8r4f; fix in PR 44744 / commit 8a5cf1ccd65e8ac7635c402c1ec0b08988bc26ca). If immediate upgrade is not possible, the most effective compensating control is to disable speculative decoding on the server, which removes the vulnerable code path entirely at the cost of the throughput/latency gains that feature provides. Additionally, restrict access to the gRPC Generate/Abort endpoints to trusted clients via network ACLs or an authenticating proxy, and place per-client rate limiting in front of the deployment so a single abusive request stream cannot repeatedly crash the shared worker; the trade-off is added infrastructure and the fact that these controls limit but do not eliminate reach for authorized-but-malicious clients. Configure automatic worker restart/supervision to shorten outage windows as a stopgap only, since it does not prevent the crash.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vLLM is a high-throughput, memory-efficient serving engine for large language models, exposing generation to clients over public gRPC endpoints (Generate/Abort). The flaw lives in the speculative decoding path: a drafter model proposes tokens that a rejection sampler accepts or rejects against the target model. The root cause maps to CWE-20 (Improper Input Validation) - the sampler can emit a 'recovered token' equal to vocab_size (an out-of-bounds index into a 0..vocab_size-1 embedding table). When the engine selects the next live token, that boundary value is converted to -1 and fed back into the drafter's input ids; the subsequent embedding lookup and attention computation index out of range on the GPU, and CUDA's device-side assertion aborts the worker process. The affected component is cpe:2.3:a:vllm-project:vllm across all versions before the fix.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated client crashes the shared worker with legal requests (AV:N/PR:N/AC:L); impact is availability-only DoS, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into the drafter's input ids; that out-of-vocabulary value is later consumed by the model's embedding and attention path and crashes the engine worker with a GPU device-side assertion. The same triggering request sequence is reachable through the public gRPC Generate and Abort endpoints, so a remote client that can send generation requests can crash the shared engine worker, aborting concurrent requests and causing a service-wide denial of service for other clients of the deployment until the worker is restarted. This issue is fixed in version 0.24.0.
Executive ViewAI
vLLM inference server (versions prior to 0.24.0) can be remotely crashed by adversaries exploiting a denial-of-service vulnerability in speculative decoding, with no public exploit identified at time of analysis. Organizations running vLLM face complete loss of LLM inference availability; with no patch currently available, interim protections are essential to maintain operational continuity.
No vendor-released patch identified at time of analysis. Implement request rate limiting and payload validation to constrain speculative decoding workloads; disable speculative decoding feature if business operations permit; configure automatic worker process restart upon crash detection; apply network segmentation to limit attack surface; enable comprehensive logging and alerting for worker crashes; maintain incident logs for vendor engagement and forensic analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Memory exhaustion in vLLM 0.22.0-0.23.0 allows authenticated API callers to crash or destabilize the inference server by
Exploit-DB