CVE-2026-115916

vLLM token boundary error can poison the CUDA context

vLLM project · vLLM tokenizer validation and embedding lookup

First documented disclosure · Review checkpoint

Summary

A pre-tokenized prompt could pass validation with an identifier one beyond the vocabulary and terminate the engine.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The maximum-token calculation treated the vocabulary count as a valid inclusive identifier.

Conditions required

Tensor-parallel size 1 and a vocabulary exactly divisible by 64 without padded headroom, plus access to pre-tokenized input.

Potential impact

CUDA assertion and denial of service to the affected model instance.

Affected versions and configurations

Before 0.32.0.

Fix and mitigation status

0.32.0.

Practical next steps

Upgrade and reject token identifiers outside the model’s actual embedding bounds.

Operating lesson

Validate identifiers against the consuming buffer, not a count with ambiguous inclusive bounds.

Evidence and limits

Public September 30 patch predates October 20 advisory and October 26 CVE publication. The described crash does not apply to every model; the report specifically excludes Qwen2.5’s padded configuration.

Sources