vLLM: out-of-vocabulary stop_token_ids kill EngineCore and take the model server down until restart

Impact

The Rust HTTP and gRPC frontends in 0.22.0 through 0.23.0 do not bound-check stop_token_ids against the vocabulary before they reach MinTokensLogitsProcessor. A request with min_tokens greater than zero and an out-of-vocabulary stop token id triggers a CUDA tensor indexing failure that leaves EngineCore in a fatal state - the server does not recover on its own and has to be restarted. Any client that can send an inference request can do this, so a single malformed request drops a model replica that may hold tens of gigabytes of weights across several GPUs. Recovery means a cold start including model load, which on large models is minutes of lost capacity per hit, and the request can simply be repeated. No data disclosure or code execution is claimed.

Who can reach it

Anyone who can send an inference request to the vLLM endpoint. No authentication is required unless the operator has put one in front of it.

What to do

Upgrade vLLM past 0.23.0 to the version named in the project advisory and restart the serving processes - a per-replica daemon restart with model reload, which can be done as a rolling replacement behind the router. If you cannot upgrade now, reject or clamp stop_token_ids at the gateway so ids outside the model's vocabulary never reach vLLM, and make sure the supervisor restarts a wedged EngineCore automatically.

References

Related entries

• SGLang: a one-character request id lets any client abort every other client's in-flight generationCVE-2026-112266 · SGLang (tokenizer_manager request-id abort handling)High
• vLLM Rust gRPC frontend: oversized CandidateTokens.top_n bypasses max_logprobs and kills EngineCoreCVE-2026-116172 · vLLM Rust gRPC converter (CandidateTokens.top_n)High
• vLLM Rust gRPC frontend: >128 output_candidates.token_ids triggers a fatal sampler exceptionCVE-2026-116173 · vLLM Rust gRPC frontend (output_candidates.token_ids / logprob_token_ids limit)High
• vLLM Rust gRPC frontend: out-of-vocabulary prompt token ids kill EngineCore via embedding lookupCVE-2026-116174 · vLLM Rust gRPC Generate/GenerateStream (unchecked prompt.token_ids)High
• vLLM: inconsistent multimodal metadata on the disaggregated generate endpoint crashes the engineCVE-2026-116178 · vLLM disaggregated /inference/v1/generate (multimodal mm_placeholders / mm_hashes handling)High
• MLflow: unauthenticated SSRF in get-artifacts discloses information from the tracking serverCVE-2026-118628 · MLflow tracking server (get-artifacts URI validation)High