Live › vulnerability › CVE-2026-115916
Go to dashboardA pre-tokenized prompt containing a token ID equal to the vocabulary size passes validation in vLLM before 0.32.0. On a single-GPU setup with a vocabulary that is an exact multiple of 64, the embedding layer hits a CUDA device-side assertion and the engine process terminates, which is a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
Teams self-hosting vLLM for inference on a single GPU (tensor-parallel size one) with a model whose vocabulary size is an exact multiple of 64. The flaw needs a request that supplies pre-tokenized prompt IDs, so an endpoint that only accepts text prompts is less exposed. Teams using hosted model APIs or multi-GPU tensor-parallel setups are less likely to be hit.
No product ranges from the sources yet.
python -c "import vllm; print(vllm.__version__)" and check whether the result is below 0.32.01 and serves a model whose vocabulary size is an exact multiple of 640.32.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it, causing a CUDA device-side assertion and terminating the engine. This issue is fixed in version 0.32.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115916")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.