---
id: "CVE-2026-115916"
kind: "vulnerability"
aliases: ["CVE-2026-115916"]
title: "vLLM: an out-of-range prompt token ID crashes the serving engine"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "gpu-inference", "python", "self-hosted", "vllm"]
not_affected_if: ["managed-hosting", "text-prompts-only"]
published_at: "2026-10-26T18:17:39+00:00"
first_seen_at: "2026-10-26T18:31:43+00:00"
updated_at: "2026-10-26T18:34:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115916", "first_seen_at": "2026-10-26T18:31:43+00:00"}]
---

# vLLM: an out-of-range prompt token ID crashes the serving engine

A pre-tokenized prompt containing a token ID equal to the vocabulary size passes validation in vLLM before 0.32.0. On a single-GPU setup with a vocabulary that is an exact multiple of 64, the embedding layer hits a CUDA device-side assertion and the engine process terminates, which is a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `python -c "import vllm; print(vllm.__version__)"` and check whether the result is below `0.32.0`
- Check whether the deployment runs with tensor-parallel size `1` and serves a model whose vocabulary size is an exact multiple of 64
- Check whether clients can send pre-tokenized prompt IDs directly to the server

## Fix

- Upgrade vLLM to `0.32.0` or later
- Until upgraded, limit who can submit requests to the serving endpoint, since the crash needs a crafted token ID

## Timeline

- 2026-10-26T18:31:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115916

## From the sources

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it, causing a CUDA device-side assertion and terminating the engine. This issue is fixed in version 0.32.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_