CVE-2026-54234 — vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection

2026-10-03T20:35:41.571616+00:00

Affected: vllm-project vllm

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into the drafter's input ids; that out-of-vocabulary value is later consumed by the model's embedding and attention path and crashes the engine worker with a GPU device-side assertion. The same triggering request sequence is reachable through the public gRPC Generate and Abort endpoints, so a remote client that can send generation requests can crash the shared engine worker, aborting concurrent requests and causing a service-wide denial of service for other clients of the deployment until the worker is restarted. This issue is fixed in version 0.24.0.

GHSA-8wr5-jm2h-8r4f — vLLM has Remote DoS via Invalid Recovered Token Reinjection

2026-10-03T20:35:41.571672+00:00

Affected: PyPI: vllm

## Summary

A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to `vocab_size`, convert that value to `-1` when choosing the next live token for a request, and then feed that `-1` back into the next drafter input ids. On Qwen3 GPTQ this reaches the worker-side drafting / attention path and crashes the engine with a GPU `device-side assert`.

The same issue is reachable through the public gRPC request surface by sending a specific overlapping `Generate` / `Abort` sequence.

## Impact

- A remote client that can send public gRPC generation requests can crash the shared vLLM engine worker - The triggering request sequence aborts concurrent requests and prevents later requests from completing until the worker is restarted - In shared deployments, this is a service-wide denial of service for other clients, not just a failure isolated to the attacking requests - The failure is reproducible, so repeated request sequences can sustain the outage

## Affected version

- Confirmed on vLLM `0.17.1` - Earlier and later versions have not been checked yet in this report

## Repro model

- Official Hugging Face repo: - [`Qwen/Qwen3-0.6B-GPTQ-Int8`](https://huggingface.co/Qwen/Qwen3-0.6B-GPTQ-Int8) - Anyone wants to reproduce the bug with my PoC scripts should download `Qwen3-0.6B-GPTQ-Int8` first

## Trigger chain

1. A legal multi-request speculative workload keeps structured-output state, speculative decoding,…

Most recent entries from all

CVE-2026-54234 — vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection

GHSA-8wr5-jm2h-8r4f — vLLM has Remote DoS via Invalid Recovered Token Reinjection