The vulnerability in vllm prior to version 0.29.0 arises from validating allowed_token_ids against the tokenizer length rather than the model output logits width in the SamplingParams._validate_allowed_token_ids() function. This improper validation allows attackers to provide token IDs exceeding the output vocabulary size, which corrupts the LogitBiasState managing GPU logits. As a result, concurrent requests can sample tokens outside their intended allowlists, potentially bypassing token restrictions.

Attackers can manipulate token sampling by supplying out-of-range token IDs, leading to corruption of GPU logits state and allowing concurrent requests to sample tokens outside their allowlists. This could undermine token-based restrictions in the model's output generation process. No known exploits in the wild have been reported.

Upgrade to vllm version 0.29.0 or later, where this validation issue has been corrected. Patch status is confirmed by the affectedVersions field indicating versions before 0.29.0 are vulnerable. No vendor advisory content is provided, so check the official vllm-project resources for the official fix and further guidance.