CVE-2026-115916: vLLM crash from off-by-one token ID validation in pre-tokenized prompts

Summary

vLLM versions prior to 0.32.0 contain an off-by-one error in vllm/tokenizers/hf.py, where max_token_id is computed with an incorrect upper bound. A pre-tokenized prompt ID equal to the vocabulary size passes validation, and with tensor-parallel size one and a vocabulary that is an exact multiple of 64, VocabParallelEmbedding.forward does not mask it before F.embedding uses it. This triggers a CUDA device-side assertion that terminates the engine.

Mitigation

Fixed in 0.32.0.

Topics

• Inference infrastructure

Related items

• MediumCVE-2026-115922: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0…Similar attack · NVD/CVE Database
• MediumCVE-2026-115921: ONNX shape inference crash from malicious model scan attributesSimilar attack · NVD/CVE Database
• MediumCVE-2026-115920: ONNX ConvTranspose shape inference crash from malformed weight tensorSimilar attack · NVD/CVE Database
• MediumCVE-2026-115919: ONNX shape inference out-of-bounds read via malformed RNN, LSTM and GRU nodesSimilar attack · NVD/CVE Database
• MediumCVE-2026-115918: vLLM Jinja chat template injection through /v1/responses endpointSimilar attack · NVD/CVE Database