Vulnerabilities

Vulnerability · CVE-2026-115916

vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

Published Oct 26, 2026 · catalog updated Oct 28, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 7, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115916. EPSS is 0.31%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Severity

Medium6.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.31%

Remediation

Version ranges on file

Affected products

pip vllm

For a model whose vocabulary size is an exact multiple of the embedding padding size (64) — e.g. any Llama-2-family model, vocab 32000 — a single request carrying a pre-tokenized prompt with token id equal to the vocab size (32000) passes vLLM's input-id validation but is one past the last embedding row. At tensor-parallel size 1 the embedding lookup does not mask indices, so the id reaches out of range and raises a CUDA device-side assert, which poisons the engine's CUDA context and takes the engine down. Any client that can send pre-tokenized input ( with as token ids, -fed flows, or the reuse path) can trigger it. ## Root cause accepts a token id when . computes . For Llama-2 tokenizers but , so — one greater than the largest valid id. The engine bound therefore becomes , and id 32000 is accepted. The model's embedding has rows (no padding), valid indices 0..31999. At with there is no masking, so index 32000 hits out of range. ## Affected - tp=1 (single GPU per model — common per-copy layout). tp>1 masks via , so the id is clamped, not an OOB — likely wrong output rather than a crash. - Models whose vocab is a multiple of 64 with one past the max real id (Llama-2 family, vocab 32000, is the clear case). Qwen2.5 is NOT affected (padded headroom). ## Suggested fix max_token_id in vllm/tokenizers/hf.py now uses tokenizer.vocab_size - 1, so an id equal to the vocabulary size fails input validation instead of reaching the embedding. Fixed in [MR59491](https://github.com/vllm-project/vllm/pull/59491), released in v0.32.0. ## Reporter Shijie Lyu (GitHub shijie-lyu lshjhf@gmail.com). Reported privately per SECURITY. This advisory was fixed in [MR59491](https://github.com/vllm-project/vllm/pull/59491).