CVE-2026-100654

[CVE catalog]

Severity

High · CVSS 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Sep 13, 2026, 10:00:00 PM UTC

Updated

Sep 26, 2026, 2:16:48 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.31% · Oct 25, 2026

A flaw was found in vLLM. An authenticated remote attacker can cause a Denial of Service (DoS) by submitting a completion request containing out-of-range stop token identifiers. Because the service does not verify that user-supplied token identifiers fall within the supported vocabulary range of the model, processing these invalid values triggers a fatal error in the underlying processing engine. This causes subsequent requests to fail, rendering the service unavailable until it is restarted. vllm: vLLM: Denial of Service via out-of-range stop token identifiers In Red Hat Enterprise Linux AI and Red Hat OpenShift AI environments, this vulnerability is rated with a Moderate severity because exploitation requires authenticated access to the model serving interface, and the blast radius is confined to service availability. Submitting crafted generation requests with stop token identifiers outside the model vocabulary boundary during constrained generation triggers a fatal GPU assertion in the inference engine. Although the resulting crash causes the serving process to stop responding until restarted, the flaw does not compromise data confidentiality or allow execution of arbitrary code. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.