CVE-2026-100652: vllm Package Vulnerability Leading to Fatal CUDA Tensor Indexing Failures
Summary
CVE-2026-100652: vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Affects vllm versions >= 0.22.0, < 0.24.0. Fixed in 0.24.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vllm package is a powerful tool designed for efficient language model serving, providing both HTTP and gRPC frontends for seamless integration into applications. It allows developers to leverage advanced machine learning models for various natural language processing tasks. However, versions 0.22.0 through 0.23.0 of vllm contain a critical vulnerability that compromises its stability and security.
Vulnerability Detail
The vulnerability arises from the failure of vllm to validate stop_token_ids against vocabulary bounds in its Rust HTTP and gRPC frontends. This oversight allows attackers to submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids. Such requests can trigger CUDA tensor indexing failures, leading to a fatal state in EngineCore that necessitates a service restart. This vulnerability poses significant risks, including service downtime and potential exploitation by malicious actors.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "vllm==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.24.0
This is the first release that contains the fix.
pip install --upgrade "vllm==0.24.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation to ensure that stop_token_ids are within the acceptable vocabulary bounds before processing requests. This can help mitigate the risk of triggering the vulnerability until the package is updated.
Conclusion
The vllm package vulnerability CVE-2026-100652 poses significant risks to applications utilizing versions 0.22.0 through 0.23.0. It is crucial for users to update to version 0.24.0 or later to mitigate these risks and ensure the stability of their services.
See every vulnerability recorded for vllm →
FAQ
CVE-2026-100652 is a vulnerability in the vllm package that allows for out-of-vocabulary token IDs to cause fatal errors in the service.
Versions 0.22.0 through 0.23.0 of the vllm package are affected by this vulnerability.
Exploitation of this vulnerability can lead to service downtime and potential denial of service due to fatal errors in the EngineCore.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for vllm.
