vLLM before version 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints. The validation only ensures the values are integers but does not verify that each token ID is within the model vocabulary or logits range. When the min_tokens parameter is greater than zero, these stop token IDs are used as indices into logits to suppress stop tokens. An out-of-range token ID causes a CUDA device-side assertion failure during an index_put_ operation. An authenticated API user can exploit this by sending a single malformed completion request that returns a 500 Internal Server Error and puts the EngineCore into a fatal state, causing subsequent requests to fail until the service is restarted, effectively resulting in a denial of service.

An authenticated user can cause a denial of service by sending a single malformed request with out-of-range stop_token_ids. This triggers a device-side assertion failure in CUDA, crashing the EngineCore and making the service unavailable until manually restarted. There is no indication of data compromise or code execution beyond service disruption.

No explicit patch or remediation is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using vulnerable versions or restrict access to trusted users to prevent exploitation.