CVE-2026-100652: vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC fron

vLLM versions 0.22.0 through 0.23.0 have a bug where they don't check if stop_token_ids (tokens that tell the AI to stop generating text) are valid for the model's vocabulary. Attackers can exploit this by sending requests with invalid token IDs, which causes the system to crash and requires restarting the service.