AI Threat AlertvLLM, a widely used LLM serving engine, has an off-by-one error in its tokenizer validation that lets an authenticated user submit a pre-tokenized prompt containing a token ID equal to the vocabulary size, triggering a CUDA device-side assertion that terminates the whole inference engine. The flaw is rated medium (CVSS 6.5, availability-only impact), but a single low-privilege network request can take down a shared serving endpoint, and vLLM has 94 tracked downstream dependents and 173 other CVEs on record, so the exposure is broad. There is no public exploit, no Nuclei template, no KEV listing, and no EPSS score yet, so mass exploitation is unlikely today; the realistic risk is a malicious or buggy API client against multi-tenant or customer-facing deployments. Upgrade to vLLM 0.32.0 or later, and until then reject token-ID prompt inputs at your gateway and make sure your orchestrator automatically restarts crashed engine processes.
What is the risk?
Medium overall. Exploitation is trivial in terms of complexity (network, low attack complexity, low privileges, no user interaction) and the impact is limited to availability, with no confidentiality or integrity loss. The conditions are narrow: tensor-parallel size of one and a vocabulary size that is an exact multiple of 64, so only some model and deployment combinations are vulnerable. Exposure is highest where vLLM's API accepts pre-tokenized prompts from untrusted or semi-trusted tenants. No exploitation in the wild is known (not in CISA KEV, no public exploit, no EPSS data, no SSVC decision).
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| vLLM | pip | < 0.32.0 | 0.32.0 |
Do you use vLLM? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade vLLM to 0.32.0 or later (fix in PR 59491 and commit 37cecc8, see GHSA-q97c-p368-75c4). 2) If you cannot patch immediately, validate at the API gateway that any pre-tokenized prompt IDs are strictly less than the model's vocabulary size, or disallow token-ID prompt inputs from untrusted clients. 3) Require authentication and per-client rate limits on inference endpoints. 4) Run vLLM under a supervisor (Kubernetes, systemd) with automatic restart and health checks, and use multiple replicas behind a load balancer to limit blast radius. 5) Detect by alerting on unexpected engine terminations and CUDA 'device-side assert triggered' errors in vLLM logs that correlate with requests containing token-ID prompts.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-115916?
vLLM, a widely used LLM serving engine, has an off-by-one error in its tokenizer validation that lets an authenticated user submit a pre-tokenized prompt containing a token ID equal to the vocabulary size, triggering a CUDA device-side assertion that terminates the whole inference engine. The flaw is rated medium (CVSS 6.5, availability-only impact), but a single low-privilege network request can take down a shared serving endpoint, and vLLM has 94 tracked downstream dependents and 173 other CVEs on record, so the exposure is broad. There is no public exploit, no Nuclei template, no KEV listing, and no EPSS score yet, so mass exploitation is unlikely today; the realistic risk is a malicious or buggy API client against multi-tenant or customer-facing deployments. Upgrade to vLLM 0.32.0 or later, and until then reject token-ID prompt inputs at your gateway and make sure your orchestrator automatically restarts crashed engine processes.
Is CVE-2026-115916 actively exploited?
No confirmed active exploitation of CVE-2026-115916 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-115916?
1) Upgrade vLLM to 0.32.0 or later (fix in PR 59491 and commit 37cecc8, see GHSA-q97c-p368-75c4). 2) If you cannot patch immediately, validate at the API gateway that any pre-tokenized prompt IDs are strictly less than the model's vocabulary size, or disallow token-ID prompt inputs from untrusted clients. 3) Require authentication and per-client rate limits on inference endpoints. 4) Run vLLM under a supervisor (Kubernetes, systemd) with automatic restart and health checks, and use multiple replicas behind a load balancer to limit blast radius. 5) Detect by alerting on unexpected engine terminations and CUDA 'device-side assert triggered' errors in vLLM logs that correlate with requests containing token-ID prompts.
What systems are affected by CVE-2026-115916?
This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference endpoints, multi-tenant AI API gateways, RAG pipelines, agent frameworks.
What is the CVSS score for CVE-2026-115916?
CVE-2026-115916 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.31%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0029Denial of AI ServiceAML.T0040AI Model Inference API AccessCompliance Controls Affected
What are the technical details?
Original Advisory
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it, causing a CUDA device-side assertion and terminating the engine. This issue is fixed in version 0.32.0.
Exploitation Scenario
An attacker with a low-privilege API key for a shared vLLM-backed service sends a completion request whose prompt is a list of token IDs that includes a value equal to the model's vocabulary size. The tokenizer validation lets it through, the embedding lookup is not masked, and a CUDA device-side assertion kills the engine. The attacker repeats the request each time the service restarts, creating a sustained denial of service for all tenants at negligible cost.
Weaknesses (CWE)
CWE-129Improper Validation of Array IndexPrimaryCWE-129Improper Validation of Array IndexPrimaryCWE-193Off-by-one ErrorPrimaryCWE-193Off-by-one ErrorPrimaryCWE-129Improper Validation of Array IndexCWE-193Off-by-one ErrorCWE-129 — Improper Validation of Array Index: The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
- [Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server. Even though client-side checks provide minimal benefits with respect to server-side security, they are still useful. First, they can support intrusion detection. If the server receives input that should have been rejected by the client, then it may be an indication of an attack. Second, client-side error-checking can provide helpful feedback to the user about the expectations for valid input. Third, there may be a reduction in server-side processing time for accidental input errors, although this is typically a small savings.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HReferences
- github.com/vllm-project/vllm/commit/37cecc8141e2dcba9dd534897a164d4baaf27229x_refsource_MISC
- github.com/vllm-project/vllm/pull/59491x_refsource_MISC
- github.com/vllm-project/vllm/releases/tag/v0.32.0x_refsource_MISC
- github.com/vllm-project/vllm/security/advisories/GHSA-q97c-p368-75c4x_refsource_CONFIRM
- github.com/advisories/GHSA-q97c-p368-75c4
- nvd.nist.gov/vuln/detail/CVE-2026-115916
Timeline
Related Vulnerabilities
CVE-2026-6173210.0Decepticon: ChatML token injection yields sandbox RCE
Same package: vllmCVE-2024-110419.8vllm: RCE via unsafe pickle deserialization in MessageQueue
Same package: vllmCVE-2026-259609.8vllm: SSRF allows internal network access
Same package: vllmCVE-2025-472779.8vLLM: RCE via exposed TCPStore in distributed inference
Same package: vllmCVE-2024-90539.8vllm: RCE via unsafe pickle deserialization in RPC server
Same package: vllm