CVE-2026-100652 – Denial of Service (EngineCore Crash) – vLLM 0.22.0 through 0.23.0

Summary

CVE-2026-100652 is an improper input validation vulnerability in vLLM’s Rust-based HTTP and gRPC API frontends. Attackers can submit inference requests containing an out-of-vocabulary stop_token_ids value together with min_tokens greater than zero, causing the token ID to be used as a GPU tensor index and triggering a fatal CUDA device-side assertion that crashes the EngineCore. The flaw affects vLLM 0.22.0 through 0.23.0 and requires a full service restart to recover, resulting in a network-exploitable, unauthenticated denial-of-service condition.

Technical details

• Root cause: An earlier fix (vLLM PR #44968) added vocabulary-bound validation for the stop_token_ids sampling parameter, but only in the Python request-handling path. The Rust HTTP and gRPC frontends expose the same parameter and forward it to the engine without equivalent validation.
• Trigger conditions: A request must supply min_tokens > 0 together with a stop_token_ids entry that falls outside the model’s vocabulary range. When min_tokens is active, the MinTokensLogitsProcessor uses the supplied stop token IDs as indices into the logits tensor via logits.index_put_().
• Attack vector: Network — reachable via the standard OpenAI-compatible /v1/completions and /v1/chat/completions HTTP endpoints, as well as the gRPC API, with no authentication or special privileges required.
• Impact: The out-of-bounds tensor index triggers a CUDA device-side assertion, putting the EngineCore into a fatal, unrecoverable state. This halts inference for all in-flight and subsequent requests until the vLLM service is manually restarted — a full-service denial of service from a single crafted request.

Affected software

• vllm-project vLLM, versions >= 0.22.0 and <= 0.23.0
• Fixed in vLLM 0.24.0 and later

Severity

• CVSS v3.1 Base Score: 5.9 (Medium) — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
• CVSS v4.0 Base Score: 8.2 (High) — CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
• CWE-20: Improper Input Validation (related: CWE-129 Improper Validation of Array Index, CWE-400 Uncontrolled Resource Consumption)

Mitigation and recommended actions

• Immediate: Upgrade vLLM deployments to version 0.24.0 or later, which adds vocabulary-bound validation for stop_token_ids in the Rust HTTP and gRPC request paths, matching the existing Python-side _validate_stop_token_ids() check.
• If immediate patching is not possible:
  • Restrict access to vLLM inference endpoints (HTTP and gRPC) to trusted internal networks or authenticated gateways, since the API accepts unauthenticated sampling parameters by default.
  • Where feasible, front the service with a request-validation proxy that rejects or strips client-supplied stop_token_ids values, or enforces bounds against the deployed model’s known vocabulary size.
  • Monitor for repeated EngineCore crashes/restarts and CUDA device-side assertion errors in vLLM logs as an indicator of attempted exploitation.
  • Have automated restart/health-check tooling in place for the vLLM service to reduce downtime impact until patched.

References

• vLLM Security Advisory (GHSA-qff2-492f-9fm4)
• CVE-2026-100652 Record (CVEProject/cvelistV5)
• CVE-2026-100652 at NIST NVD