vLLM: negative token IDs in embeddings requests poison the CUDA context and wedge the engine

Impact

A single unauthenticated request carrying a negative token ID to /v1/embeddings or /pooling trips a CUDA device-side assertion. Once that assertion fires the GPU context is poisoned, so every subsequent request on that engine fails until the process is restarted - one malformed request takes the whole model replica out of service, not just its own request. On a GPU fleet this converts a trivially cheap request into a persistent denial of service against an expensive accelerator, and it can be repeated immediately after each restart. Where the inference endpoint is reachable by tenants or by an internal gateway without auth, any caller can keep a GPU idle indefinitely.

Who can reach it

Anyone who can send HTTP requests to the vLLM API server. No authentication is required - vLLM's OpenAI-compatible server does not authenticate by default, so exposure equals whatever network reach the endpoint has (tenant pods, an internal gateway, or the public internet if fronted directly).

What to do

Upgrade vLLM to 0.28.0 or later and restart each serving process; no node reboot or driver change is needed, but every model replica has to be cycled, so drain traffic per replica to avoid a serving gap. Until then, put authentication and an input-validation proxy in front of the embeddings and pooling endpoints, or disable those endpoints if unused, and make sure the supervisor restarts a wedged engine automatically.

References

Related entries

• vLLM: incomplete NIXL kv_transfer_params kills the decode engine with an uncaught KeyErrorCVE-2026-94622 · vLLM NIXL KV connector (kv_transfer_params metadata handling)High
• vLLM: multi-prompt completion request trips a NIXL prefix-caching assertion and kills the decode workerCVE-2026-94623 · vLLM NIXL connector prefix caching (NixlBaseConnectorWorker._apply_prefix_caching)High
• vLLM: attacker-chosen P2P offload peers exhaust ZeroMQ contexts and crash EngineCoreCVE-2026-94624 · vLLM P2P KV offloading (OffloadingConnector TieringOffloadingSpec, ZeroMQ control)High
• vLLM: unvalidated tp_size in kv_transfer_params drives the decode worker into OOM-killCVE-2026-94626 · vLLM NIXL KV connector (unvalidated tp_size in kv_transfer_params)High
• vLLM: Mooncake transfer-ID collision leaks GPU KV cache blocks until restartCVE-2026-94627 · vLLM Mooncake KV connector (transfer-ID ownership of GPU KV cache blocks)High
• Gradio (`/queue/join`): SSRFCVE-2024-4325 · Gradio (`/queue/join`)High