CVE-2026-100652

[CVE catalog]

Severity

High · CVSS 8.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Sep 13, 2026, 10:00:00 PM UTC

Updated

Sep 26, 2026, 2:16:47 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.42% · Oct 25, 2026

A flaw was found in vLLM. A remote attacker can trigger a Denial of Service (DoS) by sending requests containing stop token identifiers that exceed the supported vocabulary limits. Because the application's service frontends fail to properly validate these identifiers before internal processing, the out-of-bounds values cause a fatal indexing failure during graphics processing unit (GPU) operations, crashing the core service and requiring a full restart. vllm: vLLM: Denial of Service via out-of-bounds stop token IDs This vulnerability is rated Important rather than Moderate because a remote, unauthenticated caller can crash the inference service with a single malformed generation request, resulting in a persistent denial of service. In Red Hat Enterprise Linux AI and OpenShift AI environments where vLLM exposes model serving endpoints over HTTP or gRPC, the frontend fails to validate stopping token identifiers against the active model vocabulary. When submitted with a minimum token threshold, these invalid values cause a fatal GPU execution failure that forces the entire inference engine offline until manually restarted, though the flaw cannot be leveraged for data compromise or code execution. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.