https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 30 Oct 2026 13:20:59 +0000 https://db.gcve.eu/vuln/cve-2026-115916 <p><strong>Affected:</strong> vllm-project vllm</p> <p>vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it, causing a CUDA device-side assertion and terminating the engine. This issue is fixed in version 0.32.0.</p> <p><strong>Affected:</strong> vllm-project vllm</p> <p>vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact multiple-of-64 vocabulary, VocabParallelEmbedding.forward does not mask that value before F.embedding uses it, causing a CUDA device-side assertion and terminating the engine. This issue is fixed in version 0.32.0.</p> https://db.gcve.eu/vuln/cve-2026-115916 https://db.gcve.eu/vuln/ghsa-q97c-p368-75c4 <p><strong>Affected:</strong> PyPI: vllm</p> <p>For a model whose vocabulary size is an exact multiple of the embedding padding size (64) — e.g. any Llama-2-family model, vocab 32000 — a single request carrying a pre-tokenized prompt with token id equal to the vocab size (32000) passes vLLM&#39;s input-id validation but is one past the last embedding row. At tensor-parallel size 1 the embedding lookup does not mask indices, so the id reaches `F.embedding` out of range and raises a CUDA device-side assert, which poisons the engine&#39;s CUDA context and takes the engine down. Any client that can send pre-tokenized input (`/v1/completions` with `prompt` as token ids, `/tokenize`-fed flows, or the `kv_transfer_params[&#34;prompt_token_ids&#34;]` reuse path) can trigger it.</p> <p>## Root cause `vllm/v1/engine/input_processor.py` accepts a token id when `id &lt;= max(tokenizer.max_token_id, model_config.get_vocab_size() - 1)`. `vllm/tokenizers/hf.py` computes `max_token_id = max(max(vocab.values()), tokenizer.vocab_size)`. For Llama-2 tokenizers `max(vocab.values()) = 31999` but `tokenizer.vocab_size = 32000`, so `max_token_id = 32000` — one greater than the largest valid id. The engine bound therefore becomes `max(32000, 31999) = 32000`, and id 32000 is accepted. The model&#39;s embedding has `pad_vocab_size(32000, 64) = 32000` rows (no padding), valid indices 0..31999. At `VocabParallelEmbedding.forward` with `tp_size == 1` there is no masking, so index 32000 hits `F.embedding` out of range.</p> <p>## Affected - tp=1 (single GPU per model — common per-copy l…</p> <p><strong>Affected:</strong> PyPI: vllm</p> <p>For a model whose vocabulary size is an exact multiple of the embedding padding size (64) — e.g. any Llama-2-family model, vocab 32000 — a single request carrying a pre-tokenized prompt with token id equal to the vocab size (32000) passes vLLM&#39;s input-id validation but is one past the last embedding row. At tensor-parallel size 1 the embedding lookup does not mask indices, so the id reaches `F.embedding` out of range and raises a CUDA device-side assert, which poisons the engine&#39;s CUDA context and takes the engine down. Any client that can send pre-tokenized input (`/v1/completions` with `prompt` as token ids, `/tokenize`-fed flows, or the `kv_transfer_params[&#34;prompt_token_ids&#34;]` reuse path) can trigger it.</p> <p>## Root cause `vllm/v1/engine/input_processor.py` accepts a token id when `id &lt;= max(tokenizer.max_token_id, model_config.get_vocab_size() - 1)`. `vllm/tokenizers/hf.py` computes `max_token_id = max(max(vocab.values()), tokenizer.vocab_size)`. For Llama-2 tokenizers `max(vocab.values()) = 31999` but `tokenizer.vocab_size = 32000`, so `max_token_id = 32000` — one greater than the largest valid id. The engine bound therefore becomes `max(32000, 31999) = 32000`, and id 32000 is accepted. The model&#39;s embedding has `pad_vocab_size(32000, 64) = 32000` rows (no padding), valid indices 0..31999. At `VocabParallelEmbedding.forward` with `tp_size == 1` there is no masking, so index 32000 hits `F.embedding` out of range.</p> <p>## Affected - tp=1 (single GPU per model — common per-copy l…</p> https://db.gcve.eu/vuln/ghsa-q97c-p368-75c4