CVE-2026-93840: vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in Sampling

vLLM (a library for running large language models) versions before 0.29.0 have a bug in how it checks allowed token IDs (specific outputs the model is restricted to producing). The code incorrectly checks these IDs against the tokenizer length (the number of tokens the input processor knows about) instead of the model's output vocabulary width (the actual number of different tokens the model can generate). An attacker can exploit this by providing token IDs that pass the faulty check but are actually invalid, corrupting the GPU's internal state and allowing other simultaneous requests to break out of their output restrictions.