vLLM MinTokensLogitsProcessor Out-of-Vocabulary Token Handling Flaw

Executive Summary

CVE-2026-100652 is a Denial of Service (DoS) vulnerability in vLLM versions 0.22.0 through 0.23.0. The flaw occurs because the software fails to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends. Attackers can exploit this by sending requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids, causing CUDA tensor indexing failures that crash the EngineCore and require a service restart.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor vLLM service logs for CUDA tensor indexing failures or EngineCore crashes. Check for requests with min_tokens > 0 and out-of-vocabulary stop_token_ids in HTTP/gRPC traffic. Use network monitoring tools to identify repeated service restarts or abnormal termination patterns in vLLM processes.

• Inspect vLLM logs for errors like 'fatal device-side assertion' or 'EngineCore crashed'.
• Use tools like tcpdump or Wireshark to capture and analyze HTTP/gRPC requests containing stop_token_ids.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to remotely trigger a DoS condition by sending a single malicious request to a vulnerable vLLM service. The attack crashes the EngineCore, forcing a full service restart to recover. This can lead to service downtime, disrupted operations, and potential loss of availability for systems relying on vLLM for inference tasks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts availability, which is a key requirement under GDPR and HIPAA. A DoS attack could lead to prolonged service outages, potentially violating compliance requirements for data accessibility and system reliability. Organizations using vulnerable vLLM versions may face compliance risks due to service disruptions.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade vLLM to version 0.24.0 or later to address the vulnerability. If upgrading is not possible, restrict network access to vLLM's Rust HTTP/gRPC endpoints using firewalls or network segmentation. Implement input validation to reject requests with min_tokens > 0 and out-of-vocabulary stop_token_ids.

• Apply the Rust-side validation fix for stop_token_ids as described in the GitHub advisory.
• Monitor for suspicious requests and block IPs attempting to exploit this issue.

Useful 0 Not Useful 0