CVE-2026-100654 vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids

High 7.1 Published 26 Sep 2026 Updated 30 Sep 2026

An authenticated user can cause a denial of service in vLLM by sending out-of-range stop token IDs, crashing the engine core.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-100654?

CVE-2026-100654 is a high-severity denial of service vulnerability in Vllm Vllm, published on 26 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When min_tokens > 0, the stop token ids are used as logits indices to suppress stop tokens, so an out-of-range id reaches a CUDA indexing operation (index_put_) and triggers a device-side assertion. An authenticated API user can send a single malformed completion request that returns 500 Internal Server Error and puts EngineCore into a fatal state, causing subsequent requests to fail until the service is restarted (denial of service).

Weakness: CWE-129

Which versions are affected by CVE-2026-100654?

It affects 1 product.

Products include Vllm Vllm.

How do I fix CVE-2026-100654?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-100654 being exploited?

There is no known exploitation of CVE-2026-100654 in the wild and no public exploit code.

All Vllm Vllm vulnerabilities

Sources

Also known as GHSA-9fp6-6v59-w2jx, GHSA-v5gm-qgmv-gc6c, MINI-j85r-2c5h-4r98, MINI-r968-gvv5-7h4h, MINI-wq62-c945-3674.