CVE-2026-100654: vLLM denial of service via stop_token_ids in completion endpoints

Summary

vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints, validating only that the values are integers rather than that each id falls within the model vocabulary or logits range. When min_tokens is greater than 0, an out-of-range id reaches a CUDA index_put_ operation and triggers a device-side assertion. An authenticated API user can send one malformed request that returns 500 Internal Server Error and leaves EngineCore in a fatal state, so later requests fail until the service restarts (denial of service).

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Inference infrastructure

Related items

• MediumEndor Labs’ AI SAST Finds Zero Day Memory-Amplification DoS in Anthropic’s buffa library | Endor LabsSimilar attack · Endor Labs Blog
• MediumCVE-2026-44627: Intel oneDNN integer overflow to buffer overflow in Ring 3 user applicationsSimilar attack · NVD/CVE Database
• MediumGHSA-h7c4-q426-7jh9: tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clientsSimilar attack · GitHub Advisory Database
• HighGHSA-4p8p-pjpq-2w7h: tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processSimilar attack · GitHub Advisory Database
• HighGHSA-447x-qqwf-m7xq: tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoSSimilar attack · GitHub Advisory Database