Aller au contenu
en Se connecter
8.2 Élevée

CVE-2026-100652 vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC…

Description

vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids to trigger CUDA tensor indexing failures that leave EngineCore in a fatal state requiring service restart.

Produits et versions touchés

Produit Versions touchées Corrigé en
vllm 0.24 premières → < 0.24.0 0.24.0
vllm 0.22 0.22.0 → < 0.24.0 0.24.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de vllm

Les 121 CVE de vllm →
CVE-2026-115918 vLLM is an inference and serving engine for large language models 6.5 Moyenne CVE-2026-115917 vLLM is an inference and serving engine for large language models 3.4 Faible CVE-2026-115916 vLLM is an inference and serving engine for large language models 6.5 Moyenne CVE-2026-115915 vLLM is an inference and serving engine for large language models 8.1 Élevée
Suivre cette CVE