Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-115916— vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

Quick assessment

Affected

vllm-project vllm

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

vLLM 是一个用于大型语言模型的推理与服务引擎。在 0.32.0 版本之前，在计算时存在“差一”（off-by-one）的上界错误，导致预分词提示中等于词汇表大小的 token ID 能够通过验证。当张量并行度（tensor-parallel size）为 1，且词汇表大小恰好是 64 的倍数时，在调用之前未对该值进行屏蔽（masking），从而引发 CUDA 设备端断言错误，导致引擎终止。该问题已在 0.32.0 版本中修复。

CVSS 6.5 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

Source: CVE Program / CVE List V5

Vulnerability Description

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it, causing a CUDA device-side assertion and terminating the engine. This issue is fixed in version 0.32.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

对数组索引的验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
vllm-project	vllm	< 0.32.0	-

II. Public POCs for CVE-2026-115916

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115916

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-115916 (2)

Vendor Advisories for CVE-2026-115916 (1)

🔗 Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) · Advisory · vllm-project/vllm · GitHub x_refsource_CONFIRM

Vendor Pages for CVE-2026-115916 (1)

🔗 Release v0.32.0 · vllm-project/vllm · GitHub Read full article x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-115916

Same Patch Batch · vllm-project · 2026-10-26 · 8 CVEs total

CVE-2026-115915	8.1 HIGH	vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
CVE-2026-115912	7.5 HIGH	vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insec
CVE-2026-115911	6.5 MEDIUM	vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
CVE-2026-115913	6.5 MEDIUM	vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a s
CVE-2026-115914	6.5 MEDIUM	vLLM DeepSeek-OCR image processing vulnerable to denial of service
CVE-2026-115918	6.5 MEDIUM	vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
CVE-2026-115917	3.4 LOW	vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

IV. Related Vulnerabilities

Same product: vllm

Same vendor: vllm-project

Same weakness: CWE-129