CVE-2026-100652: vLLM DOS Vulnerability in Token Validation

CVE-2026-100652 Overview

CVE-2026-100652 affects vLLM versions 0.22.0 through 0.23.0. The Rust HTTP and gRPC frontends fail to validate stop_token_ids against vocabulary bounds. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids values. The malformed input reaches MinTokensLogitsProcessor and triggers CUDA tensor indexing failures. The failure leaves EngineCore in a fatal state that requires a full service restart to recover. The flaw is categorized under improper input validation [CWE-20] and enables unauthenticated remote denial of service against vLLM inference endpoints.

Critical Impact
A single crafted request can crash the vLLM inference engine, forcing a service restart and interrupting all concurrent model-serving workloads.

Affected Products

vLLM 0.22.0
vLLM versions between 0.22.0 and 0.23.0
vLLM 0.23.0

Discovery Timeline

2026-09-26 - CVE-2026-100652 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-100652

Vulnerability Analysis

vLLM exposes HTTP and gRPC inference APIs implemented in Rust. These frontends accept generation parameters including stop_token_ids and min_tokens. The frontends do not verify that submitted token IDs fall within the model's vocabulary range before forwarding requests to the Python engine. When min_tokens is greater than zero, the MinTokensLogitsProcessor consumes the attacker-controlled token IDs and performs indexing operations against logits tensors on the GPU. Out-of-vocabulary indices trigger an unrecoverable CUDA error inside the engine worker. The EngineCore component enters a fatal state and stops processing further requests. The service must be restarted to resume inference, producing a denial of service condition for all tenants served by the affected instance.

Root Cause

The root cause is missing bounds validation on stop_token_ids at the Rust frontend layer. Input values are forwarded to downstream GPU operations without ensuring each ID is within [0, vocab_size). CUDA indexing errors are not recoverable within the current engine process model.

Attack Vector

The attack vector is network-based and requires no authentication on exposed vLLM endpoints. An attacker sends a single generation request to the HTTP or gRPC API containing min_tokens greater than zero and at least one stop_token_ids value outside the model's vocabulary range. The request propagates to MinTokensLogitsProcessor, crashes the engine, and halts service.

No verified proof-of-concept code is published. See the GitHub Security Advisory and the VulnCheck Denial of Service Advisory for technical details.

Detection Methods for CVE-2026-100652

Indicators of Compromise

Repeated EngineCore fatal errors or process restarts in vLLM server logs correlated with inbound inference requests.
CUDA runtime errors referencing device-side assertions or invalid tensor indices during logits processing.
Inference API requests containing stop_token_ids with values exceeding the model's declared vocab_size.

Detection Strategies

Inspect HTTP and gRPC request bodies at the API gateway for stop_token_ids values outside the loaded model's vocabulary bounds.
Alert on vLLM worker process crashes or systemd restarts occurring within seconds of external API traffic.
Correlate client source IPs with repeated malformed generation requests to identify probing activity.

Monitoring Recommendations

Enable structured logging on the Rust frontend and ship logs to a centralized data lake for query and correlation.
Monitor GPU driver and CUDA error counters alongside inference request rates to detect abnormal failure patterns.
Track service availability metrics for vLLM endpoints and alert on uptime regressions tied to specific request signatures.

How to Mitigate CVE-2026-100652

Immediate Actions Required

Upgrade vLLM to a release later than 0.23.0 that validates stop_token_ids against vocabulary bounds.
Restrict network exposure of vLLM HTTP and gRPC endpoints to authenticated internal clients only.
Deploy an input-validation proxy that rejects requests containing stop_token_ids outside [0, vocab_size).

Patch Information

Refer to the GitHub Security Advisory GHSA-qff2-492f-9fm4 for the fixed release and upgrade guidance. The patch adds bounds checking in the Rust frontends before parameters reach MinTokensLogitsProcessor.

Workarounds

Place a reverse proxy or API gateway in front of vLLM to validate stop_token_ids and reject out-of-range values.
Disable or constrain use of min_tokens in client-facing API schemas until the patch is applied.
Enforce authentication and per-client rate limits on inference endpoints to reduce exposure to unauthenticated abuse.

bash

# Example gateway validation pseudocode
# Reject requests where any stop_token_id falls outside the model vocabulary
if any(tid < 0 or tid >= MODEL_VOCAB_SIZE for tid in request.stop_token_ids):
    return 400, "invalid stop_token_ids"