CVE-2026-115916: 
NixOS vulnerability analysis and mitigation

CVE-2026-115916 is a Denial of Service vulnerability in vLLM, an inference and serving engine for large language models, caused by an off-by-one error in token ID validation that allows a crafted pre-tokenized prompt to crash the engine. The flaw exists in versions prior to 0.32.0 and was reported privately by researcher Shijie Lyu (GitHub: shijie-lyu) before being publicly disclosed on October 26, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium), reflecting network-accessible exploitation requiring low privileges with high availability impact (GitHub Advisory, Feedly).

The root cause is a combination of CWE-193 (Off-by-One Error) and CWE-129 (Improper Validation of Array Index) in vllm/tokenizers/hf.py. The function get_cached_tokenizer computes max_token_id as max(max(vocab.values()), tokenizer.vocab_size), but vocab_size is a count (not a zero-based index), so for tokenizers like Llama-2 (vocab size 32000, max valid ID 31999), max_token_id is set to 32000 — one past the last valid embedding row. The input processor in vllm/v1/engine/input_processor.py then accepts a prompt token ID of 32000 as valid. When tensor-parallel size is 1 and the vocabulary is an exact multiple of the 64-row embedding padding (meaning no padding rows exist), VocabParallelEmbedding.forward does not mask the out-of-range index before passing it to F.embedding, triggering a CUDA device-side assertion that poisons the CUDA context and terminates the engine. The fix, applied in PR #59491, changes the computation to max(max_token_id, tokenizer.vocab_size - 1) (GitHub Advisory, Fix PR, Commit).

Successful exploitation results in a complete denial of service for the vLLM inference engine: the CUDA context is poisoned and the engine process terminates, making all hosted LLM inference unavailable until the service is restarted. There is no confidentiality or integrity impact — attackers cannot read data or modify model outputs through this vulnerability. Any client with access to the pre-tokenized prompt input paths (/v1/completions with token ID arrays, /tokenize-fed flows, or kv_transfer_params["prompt_token_ids"] reuse) can trigger the crash, making this particularly impactful in multi-tenant or publicly exposed vLLM deployments (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly). Exploitation is straightforward for any authenticated API user: it requires only sending a single API request with a crafted pre-tokenized prompt containing a token ID equal to the vocabulary size of the loaded model, with no special tooling needed. The attack is most reliable against Llama-2 family models (vocab size 32000, a multiple of 64) running at tensor-parallel size 1 (GitHub Advisory).

1. Identify target: Locate a vLLM instance running a version prior to 0.32.0 serving a Llama-2 family model (vocabulary size 32000) or any model whose vocabulary size is an exact multiple of 64, at tensor-parallel size 1 (single GPU per model).
2. Obtain API access: Acquire low-privilege credentials or an API key sufficient to submit completion requests to the vLLM endpoint (e.g., /v1/completions).
3. Craft malicious request: Construct an API request using the pre-tokenized prompt format, supplying a token ID array that includes the value equal to the model's vocabulary size (e.g., 32000 for Llama-2). Example payload:

{
  "model": "llama-2-7b",
  "prompt": [32000]
}

4. Submit request: Send the crafted HTTP POST request to the /v1/completions endpoint. The out-of-range token ID passes input validation due to the off-by-one error.
5. Engine crash: The invalid token ID reaches F.embedding without masking, triggering a CUDA device-side assertion that poisons the CUDA context and terminates the vLLM engine process, causing a denial of service for all users (GitHub Advisory, Fix PR).

• Logs: vLLM engine logs showing a CUDA device-side assertion error (e.g., CUDA error: device-side assert triggered) immediately following an API request with a pre-tokenized prompt; unexpected engine process termination or restart events in system/service logs.
• Network: API requests to /v1/completions, /tokenize, or similar endpoints where the prompt field is an integer array containing a value equal to or greater than the model's vocabulary size (e.g., 32000 for Llama-2 models).
• Process: Sudden termination of the vLLM engine worker process (e.g., Python process exit with non-zero code) correlated with an incoming API request; CUDA context errors in GPU driver logs (nvidia-smi showing process exit or GPU reset events).

The primary remediation is to upgrade vLLM to version 0.32.0 or later, which includes the fix in PR #59491 changing max_token_id computation from tokenizer.vocab_size to tokenizer.vocab_size - 1 (vLLM Release, Commit). As a temporary workaround for deployments that cannot immediately upgrade, operators should restrict API access to trusted clients only and consider implementing an API gateway or middleware layer that validates pre-tokenized prompt token IDs against the model's actual vocabulary size before forwarding requests to vLLM. Deployments using tensor-parallel size greater than 1 are not vulnerable to the crash (though they may produce incorrect outputs), so increasing TP size is another interim mitigation for affected model configurations (GitHub Advisory).