CVE-2026-100654

Vllm: denial of service

Risk score: 44/100
CVSS: 6.5 v3.1
Exploit chance (30 days): 0.3%
Published: 26 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When min_tokens > 0, the stop token ids are used as logits…
Affected: Vllm before 0.29.0
Fix: Upgrade Vllm to 0.29.0 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Vllm: Amber, patch this week. vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids to trigger CUDA ten…

The flaws

CVE-2026-100654: Denial of service (CVSS 6.5 · EPSS 0%)
CVE-2026-100652: Improper input validation (CVSS 7.5 · EPSS 0%)
CVE-2026-105759: VLLM is an inference and serving engine for large language models (CVSS 7.5 · EPSS 0%)
CVE-2026-103241: Denial of service (CVSS 7.5 · EPSS 1%)

The fix

Upgrade Vllm: 0.29.0 · 0.30.0 or later on your release line

Who is exposed: Vllm

Where it stands

Public proof of concept

Connects to

Same weakness: CWE-129 (CWE-129). 23 other warnings in 30 days
Same product: Earlier Vllm warnings. 15 in the last 90 days

Why it is Yellow

CVSS 6.5 medium

References

Original description

vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When min_tokens > 0, the stop token ids are used as logits indices to suppress stop tokens, so an out-of-range id reaches a CUDA indexing operation (index_put_) and triggers a device-side assertion. An authenticated API user can send a single malformed completion request that returns 500 Internal Server Error and puts EngineCore into a fatal state, causing subsequent requests to fail until the service is restarted (denial of service).

Last activity 26 Sep 2026. Patch Forecast updates every hour.