{"id":"GHSA-qff2-492f-9fm4","kind":"vulnerability","aliases":["GHSA-qff2-492f-9fm4"],"related":[],"title":"Rust HTTP/gRPC stop_token_ids bypass Python vocab-bound fix and can terminate EngineCore","description":"## Summary\n\nPublic PR `#44968` fixes a vLLM denial-of-service condition where user-supplied `stop_token_ids` outside `[0, vocab_size)` can reach `MinTokensLogitsProcessor` when `min_tokens > 0`, get used as CUDA tensor indices in `logits.index_put_`, trigger a device-side assertion, and leave EngineCore in a fatal state requiring restart.\n\nThat PR currently changes only the Python request path. Current Rust HTTP and Rust gRPC frontends expose the same `stop_token_ids` control, validate nearby token-id fields such as `prompt`, `allowed_token_ids`, and `logit_bias`, but do not vocab-bound `stop_token_ids`. The Rust paths forward those IDs into `EngineCoreSamplingParams.all_stop_token_ids`, which is the set consumed by the same Python min-tokens logits processor.\n\nThis is a sibling-callsite/incomplete-fix variant: after the Python-side fix, Rust OpenAI-compatible HTTP and Rust gRPC callers can still submit an out-of-vocabulary stop token with `min_tokens > 0` and reach the fatal CUDA indexing sink.\n\n## Technical Details\n\nThe Python request path currently only checks that `stop_token_ids` are integers:\n\n```python\nassert isinstance(self.stop_token_ids, list)\nif not all(isinstance(st_id, int) for st_id in self.stop_token_ids):\n    raise ValueError(...)\n```\n\nPR `#44968` adds the missing Python vocab-bound validator. The same PR explains the fatal sink:\n\n```text\nstop_token_ids with out-of-range values crash EngineCore via a CUDA\ndevice-side assertion.\n```\n\nThe shared runtime path is in `MinTokensLogitsProcessor`. When `min_tokens` is active, it takes `params.all_stop_token_ids`:\n\n```python\nreturn min_tokens, output_tok_ids, params.all_stop_token_ids\n```\n\nand later indexes logits with those token IDs:\n\n```python\nlogits.index_put_(self.logits_slice, self.neg_inf_tensor)\n```\n\nand on the spec-decode path:\n\n```python\nlogits.index_put_(logits_slice, self.neg_inf_tensor)\n```\n\nThe Rust HTTP OpenAI routes expose and forward the same field:\n\n```rust\npub stop_token_ids: Option<Vec<u32>>,\n...\nstop_token_ids: request.stop_token_ids,\n```\n\nThe Rust validators already check neighboring token-id fields, but not `stop_token_ids`:\n\n```rust\nvalidate_prompt_token_ids(&request.prompt, prompt_bound)?;\nvalidate_allowed_token_ids(request.allowed_token_ids.as_deref(), tokenizer_vocab_size)?;\nvalidate_logit_bias(request.logit_bias.as_ref(), model_vocab_size.unwrap_or(usize::MAX))\n```\n\nChat completions has the same gap:\n\n```rust\nvalidate_allowed_token_ids(request.allowed_token_ids.as_deref(), tokenizer_vocab_size)?;\nvalidate_logit_bias(request.logit_bias.as_ref(), model_vocab_size.unwrap_or(usize::MAX))\n```\n\nRust gRPC also forwards caller-supplied stopping criteria without a range check:\n\n```rust\nif !s.stop_token_ids.is_empty() {\n    params.stop_token_ids = Some(s.stop_token_ids.clone());\n}\n```\n\nFinally, Rust text lowering copies those IDs into the engine-facing stop set:\n\n```rust\nlet mut all_stop_token_ids = BTreeSet::from_iter(stop_token_ids.iter().copied());\n...\nEngineCoreSamplingParams {\n    stop_token_ids,\n    all_stop_token_ids,\n    ...\n}\n```\n\nThe issue is therefore not that `stop_token_ids` exist. The issue is that Rust frontend paths bypass the same vocab-bound validation that Python is adding before the exact fatal sink documented in PR `#44968`.\n\nvLLM intentionally supports stop token IDs, and `min_tokens` intentionally masks stop tokens until the minimum length is reached. It does not intend arbitrary client token IDs outside the served vocabulary to be used as GPU tensor indices.\n\nThe intended contract is visible in three places:\n\n- PR `#44968` adds `_validate_stop_token_ids()` to reject IDs outside `[0, vocab_size)` before the request reaches GPU logits processing.\n- Rust HTTP validation already rejects out-of-vocab prompt IDs, `allowed_token_ids`, and `logit_bias` keys.\n- The public PR's test plan includes an E2E test for `stop_token_ids_out_of_vocab`, confirming out-of-vocab stop IDs should be a rejected request, not an EngineCore crash.\n\nThe Rust HTTP and gRPC frontends construct engine-facing sampling state outside the Python protocol model path, so they must enforce the same safety contract before submitting a request.\n\n## Impact\n\nAn attacker who can reach an affected Rust HTTP or Rust gRPC vLLM endpoint can send a small generation request with `min_tokens = 1` and a `stop_token_ids` entry greater than or equal to the served model vocabulary size.\n\nExpected impact is single-request denial of service for affected deployments: the Rust frontend accepts and lowers the request, and the shared Python EngineCore min-tokens processor can use the out-of-range token ID as a GPU logits tensor index. Public PR `#44968` states that this condition puts EngineCore into a fatal state and requires full service restart.\n\nThis report does not claim code execution, data access, model compromise, or persistence. It is an availability issue caused by missing Rust-side input validation for a field already identified as security-sensitive.\n\nSuggested severity: High if the Rust HTTP or Rust gRPC endpoint is network-reachable without an additional deployment-layer credential requirement.\n\nSuggested CVSS v3.1:\n\n```text\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n```\n\nIf maintainers model the affected endpoint as reachable only to already-authorized clients, the conservative score is:\n\n```text\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n```\n\nThe vLLM security policy states that DoS or partial disruption without code execution or data breach is generally Moderate, while High is appropriate for higher-impact issues or privileged network surfaces. Because the public root cause describes fatal EngineCore restart from a single malformed request, the technical impact is high availability; maintainers can choose PR:N or PR:L based on their expected Rust deployment exposure.\n\nSuggested CWEs:\n\n- `CWE-20`: Improper Input Validation\n- `CWE-129`: Improper Validation of Array Index\n- `CWE-400`: Uncontrolled Resource Consumption\n\n## Suggested Fix\n\nApply the same vocab-bound validation model to Rust HTTP and Rust gRPC before request lowering:\n\n- add a Rust helper equivalent to Python `_validate_stop_token_ids()`;\n- validate every `stop_token_ids` entry against the served vocabulary boundary when `stop_token_ids` is present;\n- apply it in both Rust OpenAI completions and chat completions validators;\n- apply equivalent validation for gRPC `StoppingCriteria.stop_token_ids` before building `SamplingParams`;\n- reject with `ApiError` or `Status::invalid_argument(...)` before submitting an engine request;\n- add regression tests for valid in-vocab IDs and invalid out-of-vocab IDs on:\n- Rust HTTP `/v1/completions`;\n- Rust HTTP `/v1/chat/completions`;\n- Rust gRPC `Generate`;\n- Rust gRPC `GenerateStream`; and\n- `min_tokens > 0`, which is the documented fatal sink precondition.\n\nKeeping the only fix in Python `SamplingParams.verify()` is insufficient for Rust frontend deployments because Rust constructs engine-facing sampling state directly.\n\n## References\n\n- vLLM security policy: `https://github.com/vllm-project/vllm/security/policy`\n- vLLM vulnerability management: `https://docs.vllm.ai/en/latest/contributing/vulnerability_management.html`\n- vLLM security guide: `https://docs.vllm.ai/en/latest/usage/security.html`\n- vLLM PR `#44968`: `https://github.com/vllm-project/vllm/pull/44968`\n\n## Appendix: Duplicate Review\n\nThis is distinct from prior local/private submissions:\n\n- `this report` / `GHSA-7rx8-56c4-pfh6`: Python OpenAI request parameters can exceed fixed sampler array budgets; it covers list length, including more than 128 stop token IDs. It does not cover a single out-of-vocabulary stop token reaching the CUDA index sink through Rust frontends.\n- `this report` / `GHSA-w2v2-5662-8v5q`: Rust gRPC accepts out-of-vocabulary prompt token IDs. That is a prompt-token embedding path, not `stop_token_ids` plus `MinTokensLogitsProcessor`.\n- `this report` / `GHSA-mmrv-74wf-6pxm`: Rust frontend remains missing sampler-control length bounds after Python input-bound work. It covers missing Rust length/resource budgets such as over-128 stop-token lists; it does not cover vocab-bound validation for a single stop ID or the public Python fix in PR `#44968`.\n- `this report` and `this report`: Rust gRPC logprob candidate selectors; different fields, different lower sampler sinks.\n\nPublic PR `#44968` is the root-cause pattern for the Python path. Its changed files are only:\n\n- `tests/v1/sample/test_logprobs.py`\n- `tests/v1/sample/test_rejection_sampler.py`\n- `tests/v1/sample/test_sampling_params_e2e.py`\n- `vllm/sampling_params.py`\n- `vllm/v1/sample/rejection_sampler.py`\n\nIt does not touch Rust HTTP validators, Rust HTTP converters, Rust gRPC conversion, or Rust text lowering. I found no prior local report or public PR covering the Rust stop-token vocab-bound sibling callsites.\n\n## Affected versions\n\n- Package: `vllm` (PyPI).\n- Affected versions: `>= 0.22.0, < 0.24.0`.\n- First stable patched version: `0.24.0`.\n\nAdvisory fixed in [#45685](https://github.com/vllm-project/vllm/pull/45685).","summary":"A request to vLLM's Rust HTTP or gRPC frontend with a stop_token_ids value outside the model vocabulary and min_tokens above zero is passed to the GPU logits code, which triggers a CUDA device-side assertion. The engine then enters a fatal state and needs a full service restart.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vllm","fixed":["0.24.0"],"affected":">= 0.22.0, < 0.24.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-129","cwe-20","cwe-400","inference","python","self-hosted","vllm"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed vLLM version with `pip show vllm` and whether it falls in `>= 0.22.0, < 0.24.0`.\n- Check whether the Rust HTTP or Rust gRPC frontend is serving requests on a network-reachable endpoint.","fix":"- `vllm` (PyPI): upgrade to `0.24.0`.","status":"open","published_at":"2026-09-12T14:43:57+00:00","first_seen_at":"2026-11-09T22:53:23+00:00","triaged_at":"2026-11-09T23:01:09+00:00","updated_at":"2026-11-09T23:01:09+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T23:01:09Z","model":"claude-haiku-5-5","output":{"fix":"- `vllm` (PyPI): upgrade to `0.24.0`.","reach":"network","title":"vLLM: out-of-vocabulary stop token crashes the inference engine via Rust frontends","impact":"medium","summary":"A request to vLLM's Rust HTTP or gRPC frontend with a stop_token_ids value outside the model vocabulary and min_tokens above zero is passed to the GPU logits code, which triggers a CUDA device-side assertion. The engine then enters a fatal state and needs a full service restart.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["vllm","python","self-hosted","inference"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Single request crashes the inference engine, requiring full service restart.","analyst_note":"","how_to_check":"- Check the installed vLLM version with `pip show vllm` and whether it falls in `>= 0.22.0, < 0.24.0`.\n- Check whether the Rust HTTP or Rust gRPC frontend is serving requests on a network-reachable endpoint.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Teams running vLLM 0.22.0 up to but not including 0.24.0 with the Rust HTTP or Rust gRPC frontend reachable by clients. A single malformed generation request can take the engine down until restart. Deployments limited to trusted clients or using only the Python request path are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001117,"input_tokens":8220,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129':31B '-20':33B '-400':35B '/incomplete-fix':227C '0':115C,124C,257C,639C '44968':98C,304C,581C,629C '492f':19A,24A '9fm4':20A,25A 'activ':350C 'add':305C,572C,630C 'ai':28B 'ai-tool':27B 'allow':181C,447C,472C,660C 'alreadi':426C,652C 'also':491C 'arbitrari':605C 'assert':81B,139C,281C,338C 'bias':186C,457C,482C,665C 'bound':10A,192C,311C,445C,567C 'btreeset':532C 'bypass':6A,562C 'caller':243C,494C 'caller-suppli':493C 'callsit':226C 'chang':152C 'chat':464C 'check':273C,427C,501C 'client':606C 'code':73B 'compat':238C 'complet':465C 'condit':106C 'confirm':684C 'consum':211C 'contract':622C 'control':171C 'copi':515C,536C 'crash':330C,699C 'criteria':497C 'cuda':77B,128C,262C,334C 'current':151C,158C,271C 'cwe':30B,32B,34B 'decod':389C 'denial':103C 'denial-of-servic':102C 'deref':451C,476C 'detail':266C 'devic':79B,137C,336C 'device-sid':78B,136C,335C 'document':578C 'e2e':675C 'empti':505C 'engin':83B,521C 'engine-fac':520C 'enginecor':15A,142C,331C,698C 'enginecoresamplingparam':537C 'enginecoresamplingparams.all':203C 'enter':85B 'exact':575C 'exist':554C 'explain':316C 'expos':165C,404C 'face':522C 'fatal':87B,145C,261C,318C,576C 'field':177C,409C,432C 'final':511C 'fix':11A,99C,234C 'forward':199C,406C,492C 'frontend':51B,164C,560C 'full':92B 'gap':469C 'get':125C 'ghsa':17A,22A 'ghsa-qff2-492f-9fm4':16A,21A 'gpu':71B,617C,646C 'grpc':50B,163C,242C,490C 'host':40B 'http':48B,160C,239C,401C,650C 'http/grpc':2A 'id':5A,56B,113C,170C,176C,183C,195C,201C,206C,277C,285C,292C,296C,300C,323C,356C,363C,367C,375C,414C,419C,422C,431C,437C,442C,449C,474C,508C,517C,531C,540C,544C,553C,587C,608C,634C,637C,659C,662C,680C,690C 'includ':673C 'index':263C,370C 'indic':130C,619C 'inf':382C,397C 'infer':36B 'int':293C 'integ':279C 'intend':604C,621C 'intent':583C,591C 'isinst':282C,290C 'issu':546C,556C 'iter':534C 'key':666C 'later':369C 'leav':141C 'length':598C 'let':526C 'list':286C 'logit':72B,185C,219C,371C,394C,456C,481C,647C,664C 'logits.index':132C,377C,392C 'lower':514C 'mask':592C 'max':463C,488C 'min':63B,122C,217C,255C,347C,359C,589C 'min-token':216C 'minimum':597C 'mintokenslogitsprocessor':120C,345C 'miss':307C 'model':60B 'model_vocab_size.unwrap':460C,485C 'mut':527C 'nearbi':173C 'need':90B 'neighbor':428C 'openai':237C,402C 'openai-compat':236C 'option':415C 'out-of-rang':325C 'out-of-vocab':654C,685C 'out-of-vocabulari':248C 'output':361C 'outsid':58B,114C,609C,638C 'params.all':353C,364C 'params.stop':506C 'pass':68B 'path':157C,198C,270C,342C,390C,561C 'place':627C 'plan':672C 'pr':97C,150C,303C,315C,580C,628C,669C 'process':648C 'processor':220C 'prompt':180C,440C,444C,658C 'pub':411C 'public':96C,668C 'put':133C,378C,393C 'python':7A,37B,155C,215C,232C,268C,280C,308C,357C,376C,391C,570C 'python-sid':231C 'qff2':18A,23A 'rais':301C 'rang':328C,500C 'reach':119C,259C,600C,645C 'ref':459C,484C 'reject':636C,653C,694C 'request':43B,156C,269C,644C,695C 'request.allowed_token_ids.as':450C,475C 'request.logit_bias.as':458C,483C 'request.prompt':443C 'request.stop':420C 'requir':147C 'restart':94B,148C 'return':358C 'rout':403C 'runtim':341C 'rust':1A,47B,159C,162C,197C,235C,241C,400C,410C,424C,438C,470C,489C,502C,512C,525C,559C,649C,701C 's.stop_token_ids.clone':510C 's.stop_token_ids.is':504C 'self':39B 'self-host':38B 'self.logits':379C 'self.neg':381C,396C 'self.stop':283C,298C 'serv':611C 'servic':93B,105C 'set':210C,524C 'share':340C 'sibl':225C 'sibling-callsit':224C 'side':80B,138C,233C,337C 'sink':264C,319C,577C 'size':117C,454C,479C,641C 'slice':380C,395C 'spec':388C 'spec-decod':387C 'st':291C,295C 'state':88B,146C 'still':245C 'stop':3A,54B,111C,168C,193C,204C,252C,275C,321C,354C,365C,412C,417C,435C,496C,523C,529C,538C,542C,551C,585C,593C,632C,678C,689C 'stop_token_ids.iter':535C 'submit':246C 'summari':95C 'suppli':110C,495C 'support':584C 'take':352C 'technic':265C 'tensor':129C,383C,398C,618C 'termin':14A 'test':671C,676C 'text':320C,513C 'therefor':548C 'three':626C 'tok':362C 'token':4A,55B,64B,112C,123C,169C,175C,182C,194C,205C,218C,253C,256C,276C,284C,299C,322C,348C,355C,360C,366C,374C,413C,418C,421C,430C,436C,441C,448C,452C,473C,477C,507C,530C,539C,543C,552C,586C,590C,594C,607C,633C,661C,679C 'token-id':174C,429C 'tool':29B 'trigger':75B,134C 'use':126C,615C 'user':109C 'user-suppli':108C 'usiz':462C,487C 'valid':172C,312C,425C,439C,446C,455C,471C,480C,568C,631C,651C 'valu':57B,329C 'valueerror':302C 'variant':228C 'vec':416C 'via':332C 'visibl':624C 'vllm':26A,41B,45B,101C,582C 'vocab':9A,116C,191C,310C,453C,478C,566C,640C,657C,683C,688C 'vocab-bound':8A,190C,309C,565C 'vocabulari':61B,251C,612C 'without':498C 'zero':66B","nicknames":[],"mitigations":[],"who_affected":"Teams running vLLM 0.22.0 up to but not including 0.24.0 with the Rust HTTP or Rust gRPC frontend reachable by clients. A single malformed generation request can take the engine down until restart. Deployments limited to trusted clients or using only the Python request path are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["vllm"],"ptokens":["vllm"],"labels":["aitooling","cwe129","cwe20","cwe400","inference","medium","pypi","python","selfhosted","vllm"],"campaign_type":null,"search_a":"'492f':19A,24A '9fm4':20A,25A 'bound':10A 'bypass':6A 'enginecor':15A 'fix':11A 'ghsa':17A,22A 'ghsa-qff2-492f-9fm4':16A,21A 'http/grpc':2A 'id':5A 'python':7A 'qff2':18A,23A 'rust':1A 'stop':3A 'termin':14A 'token':4A 'vllm':26A 'vocab':9A 'vocab-bound':8A","search_b":"'-129':31B '-20':33B '-400':35B 'ai':28B 'ai-tool':27B 'assert':81B 'code':73B 'cuda':77B 'cwe':30B,32B,34B 'devic':79B 'device-sid':78B 'engin':83B 'enter':85B 'fatal':87B 'frontend':51B 'full':92B 'gpu':71B 'grpc':50B 'host':40B 'http':48B 'id':56B 'infer':36B 'logit':72B 'min':63B 'model':60B 'need':90B 'outsid':58B 'pass':68B 'python':37B 'request':43B 'restart':94B 'rust':47B 'self':39B 'self-host':38B 'servic':93B 'side':80B 'state':88B 'stop':54B 'token':55B,64B 'tool':29B 'trigger':75B 'valu':57B 'vllm':41B,45B 'vocabulari':61B 'zero':66B","search_c":"'/incomplete-fix':227C '0':115C,124C,257C,639C '44968':98C,304C,581C,629C 'activ':350C 'add':305C,572C,630C 'allow':181C,447C,472C,660C 'alreadi':426C,652C 'also':491C 'arbitrari':605C 'assert':139C,281C,338C 'bias':186C,457C,482C,665C 'bound':192C,311C,445C,567C 'btreeset':532C 'bypass':562C 'caller':243C,494C 'caller-suppli':493C 'callsit':226C 'chang':152C 'chat':464C 'check':273C,427C,501C 'client':606C 'compat':238C 'complet':465C 'condit':106C 'confirm':684C 'consum':211C 'contract':622C 'control':171C 'copi':515C,536C 'crash':330C,699C 'criteria':497C 'cuda':128C,262C,334C 'current':151C,158C,271C 'decod':389C 'denial':103C 'denial-of-servic':102C 'deref':451C,476C 'detail':266C 'devic':137C,336C 'device-sid':136C,335C 'document':578C 'e2e':675C 'empti':505C 'engin':521C 'engine-fac':520C 'enginecor':142C,331C,698C 'enginecoresamplingparam':537C 'enginecoresamplingparams.all':203C 'exact':575C 'exist':554C 'explain':316C 'expos':165C,404C 'face':522C 'fatal':145C,261C,318C,576C 'field':177C,409C,432C 'final':511C 'fix':99C,234C 'forward':199C,406C,492C 'frontend':164C,560C 'gap':469C 'get':125C 'gpu':617C,646C 'grpc':163C,242C,490C 'http':160C,239C,401C,650C 'id':113C,170C,176C,183C,195C,201C,206C,277C,285C,292C,296C,300C,323C,356C,363C,367C,375C,414C,419C,422C,431C,437C,442C,449C,474C,508C,517C,531C,540C,544C,553C,587C,608C,634C,637C,659C,662C,680C,690C 'includ':673C 'index':263C,370C 'indic':130C,619C 'inf':382C,397C 'int':293C 'integ':279C 'intend':604C,621C 'intent':583C,591C 'isinst':282C,290C 'issu':546C,556C 'iter':534C 'key':666C 'later':369C 'leav':141C 'length':598C 'let':526C 'list':286C 'logit':185C,219C,371C,394C,456C,481C,647C,664C 'logits.index':132C,377C,392C 'lower':514C 'mask':592C 'max':463C,488C 'min':122C,217C,255C,347C,359C,589C 'min-token':216C 'minimum':597C 'mintokenslogitsprocessor':120C,345C 'miss':307C 'model_vocab_size.unwrap':460C,485C 'mut':527C 'nearbi':173C 'neighbor':428C 'openai':237C,402C 'openai-compat':236C 'option':415C 'out-of-rang':325C 'out-of-vocab':654C,685C 'out-of-vocabulari':248C 'output':361C 'outsid':114C,609C,638C 'params.all':353C,364C 'params.stop':506C 'path':157C,198C,270C,342C,390C,561C 'place':627C 'plan':672C 'pr':97C,150C,303C,315C,580C,628C,669C 'process':648C 'processor':220C 'prompt':180C,440C,444C,658C 'pub':411C 'public':96C,668C 'put':133C,378C,393C 'python':155C,215C,232C,268C,280C,308C,357C,376C,391C,570C 'python-sid':231C 'rais':301C 'rang':328C,500C 'reach':119C,259C,600C,645C 'ref':459C,484C 'reject':636C,653C,694C 'request':156C,269C,644C,695C 'request.allowed_token_ids.as':450C,475C 'request.logit_bias.as':458C,483C 'request.prompt':443C 'request.stop':420C 'requir':147C 'restart':148C 'return':358C 'rout':403C 'runtim':341C 'rust':159C,162C,197C,235C,241C,400C,410C,424C,438C,470C,489C,502C,512C,525C,559C,649C,701C 's.stop_token_ids.clone':510C 's.stop_token_ids.is':504C 'self.logits':379C 'self.neg':381C,396C 'self.stop':283C,298C 'serv':611C 'servic':105C 'set':210C,524C 'share':340C 'sibl':225C 'sibling-callsit':224C 'side':138C,233C,337C 'sink':264C,319C,577C 'size':117C,454C,479C,641C 'slice':380C,395C 'spec':388C 'spec-decod':387C 'st':291C,295C 'state':146C 'still':245C 'stop':111C,168C,193C,204C,252C,275C,321C,354C,365C,412C,417C,435C,496C,523C,529C,538C,542C,551C,585C,593C,632C,678C,689C 'stop_token_ids.iter':535C 'submit':246C 'summari':95C 'suppli':110C,495C 'support':584C 'take':352C 'technic':265C 'tensor':129C,383C,398C,618C 'test':671C,676C 'text':320C,513C 'therefor':548C 'three':626C 'tok':362C 'token':112C,123C,169C,175C,182C,194C,205C,218C,253C,256C,276C,284C,299C,322C,348C,355C,360C,366C,374C,413C,418C,421C,430C,436C,441C,448C,452C,473C,477C,507C,530C,539C,543C,552C,586C,590C,594C,607C,633C,661C,679C 'token-id':174C,429C 'trigger':134C 'use':126C,615C 'user':109C 'user-suppli':108C 'usiz':462C,487C 'valid':172C,312C,425C,439C,446C,455C,471C,480C,568C,631C,651C 'valu':329C 'valueerror':302C 'variant':228C 'vec':416C 'via':332C 'visibl':624C 'vllm':101C,582C 'vocab':116C,191C,310C,453C,478C,566C,640C,657C,683C,688C 'vocab-bound':190C,309C,565C 'vocabulari':251C,612C 'without':498C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-12T14:43:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-qff2-492f-9fm4","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-qff2-492f-9fm4","severity":"medium","published_at":"2026-09-12T14:43:57+00:00","modified_at":"2026-10-27T22:09:20+00:00","first_seen_at":"2026-11-09T22:53:23+00:00","fetched_at":"2026-11-09T22:53:23+00:00","note":null}],"documents":[{"id":110590,"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-qff2-492f-9fm4","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}