Disclosed weakness · no CVE recorded

vLLM can crash when tokenizer-disabled serving accepts an invalid token ID

vLLM · EngineCore / pre-tokenized input

First documented disclosure · Review checkpoint

Summary

One request can stop inference for every client on a shared engine.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The maintainer describes a controlled crash and a regression test. No reviewed evidence establishes malicious use.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Vocabulary validation depends on a tokenizer being present. A raw positive token ID outside the model vocabulary reaches the embedding lookup and causes a fatal engine error.

Conditions required

An accessible raw-token inference endpoint running with --skip-tokenizer-init. A client needs ordinary access where authentication is enabled.

Potential impact

The affected engine and API service stop. Restart is required to recover service.

Affected versions and configurations

0.28.0 through versions before 0.33.0, according to the maintainer advisory.

Fix and mitigation status

0.33.0 according to vLLM. Its package was published November 2.

Practical next steps

Upgrade to a release containing the 0.33.0 fix. Validate raw token IDs against the model vocabulary before forwarding requests.

Operating lesson

Pre-tokenized APIs still need model-specific input checks, even when they deliberately skip the tokenizer.

Evidence and limits

The public fix proposal dates to October 21 and the detailed advisory to November 2. The prior tokenizer-enabled and negative-token advisories have different trigger conditions. The reviewed advisory does not assign a CVE.

Sources