Cloudanix VulnDB

CVE-2026-115916

Medium · 6.5

CVSS

6.5

EPSS

0.3%

Published

Oct 26, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the software that runs large language models lets attackers send specially crafted input that crashes the system and stops it from answering requests.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

An off-by-one error in token ID validation permits a pre-tokenized prompt containing an ID equal to vocabulary size to reach VocabParallelEmbedding.forward; when tensor parallelism is one and vocabulary size is a multiple of 64, the value is not masked before F.embedding, triggering a CUDA device-side assertion that terminates the inference engine.

Why it matters to the business

Attackers can remotely crash the LLM serving engine, causing denial of service and interrupting model inference workloads until the process is restarted.

How an attack unfolds

An attacker crafts a pre-tokenized prompt whose token ID equals the model vocabulary size, submits it via the API to a vLLM instance running with tensor-parallel size one and vocabulary size divisible by 64, and triggers the unmasked index access that crashes the CUDA kernel and terminates the engine.

How to fix it

Upgrade vLLM to version 0.32.0 or later, which corrects the off-by-one bound in token ID validation.

How to confirm the fix worked

Confirm the installed vLLM version is 0.32.0 or newer; attempt to submit a token ID equal to vocabulary size and verify the request is rejected before reaching the embedding layer.

Typical attack path

  1. Identify a vLLM endpoint and confirm tensor-parallel size of one
  2. Obtain or infer the target model's vocabulary size (multiple of 64)
  3. Construct a pre-tokenized prompt containing a token ID equal to vocabulary size
  4. Submit the prompt through the inference API
  5. Observe CUDA assertion failure and engine termination

How to detect it

Search inference service logs for CUDA device-side assertion failures, unexpected worker process terminations, and restart events immediately following prompt submissions; correlate with API request logs containing unusually large token IDs.

What your security team should do

  • Immediately upgrade all vLLM deployments to 0.32.0
  • Restrict API access to trusted clients until patches are applied
  • Monitor inference service availability and automate restarts for crashed workers
  • Review tensor-parallel configurations and consider enabling stricter input validation where possible

The record

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it, causing a CUDA device-side assertion and terminating the engine. This issue is fixed in version 0.32.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities