CVE-2026-100654
Received Received - Intake

vLLM EngineCore Denial of Service via Invalid Stop Token IDs

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When min_tokens > 0, the stop token ids are used as logits indices to suppress stop tokens, so an out-of-range id reaches a CUDA indexing operation (index_put_) and triggers a device-side assertion. An authenticated API user can send a single malformed completion request that returns 500 Internal Server Error and puts EngineCore into a fatal state, causing subsequent requests to fail until the service is restarted (denial of service).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100654
EUVD
EUVD-2026-87748

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vllm_project vllm to 0.29.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects vLLM versions before 0.29.0. It involves improper validation of user-controlled stop_token_ids in the OpenAI-compatible API endpoints. When min_tokens is greater than 0, these IDs are used as logits indices. If an out-of-range token ID is provided, it triggers a CUDA indexing operation that causes a device-side assertion failure, putting EngineCore into a fatal state and causing subsequent requests to fail until the service is restarted.

Detection Guidance

To detect this vulnerability, monitor API server logs for 500 Internal Server Error responses from the /v1/completions or /v1/chat/completions endpoints. Check for requests with out-of-range stop_token_ids or min_tokens > 0. Use network traffic analysis tools to inspect malformed requests targeting these endpoints.

Impact Analysis

An authenticated API user can exploit this to send a single malformed request that crashes the vLLM service, resulting in a denial of service. The service will return 500 errors for all subsequent requests until manually restarted. This disrupts availability of the API and any dependent applications.

Mitigation Strategies

Upgrade vLLM to version 0.29.0 or later to address the vulnerability. Implement input validation to ensure stop_token_ids are within the model's vocabulary range before processing. Restrict API access to trusted users only and monitor for suspicious requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100654. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart