Vulnpedia
← Search CVEs

CVE-2026-100654

HIGH 7.1

Published 2026-09-26 · Last modified 2026-09-30

vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When min_tokens > 0, the stop token ids are used as logits indices to suppress stop tokens, so an out-of-range id reaches a CUDA indexing operation (index_put_) and triggers a device-side assertion. An authenticated API user can send a single malformed completion request that returns 500 Internal Server Error and puts EngineCore into a fatal state, causing subsequent requests to fail until the service is restarted (denial of service).

ELEVATED IMPACT

Severe if exploited (CVSS 7.1), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 24th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.1CVSS 4.0 · HIGH

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Vllm Project Vllm

Products Vllm

Weakness (CWE)

  • CWE-129: Improper Validation of Array Index

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Vendor product assessments

  • rhaii/vllm-cpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cpu-rhel9@sha256:81c5994dc20321f8bd3969099eade78ef127cbd79f2d0ccea101c773e4c7fa4d?repository_url=registry.redhat.io/rhaii/vllm-cpu-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhaii/vllm-cuda-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cuda-rhel9@sha256:0d22e2301ce26ef68effda5d3a4a20381ad0ea34d1240e159e245bd44c2e125b?repository_url=registry.redhat.io/rhaii/vllm-cuda-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhaii/vllm-gaudi-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-gaudi-rhel9@sha256:ce1e4fd82dd37d299ce8c64a237971d00faf602f06868c986e81aefa04c283ef?repository_url=registry.redhat.io/rhaii/vllm-gaudi-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhaii/vllm-neuron-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-neuron-rhel9@sha256:1079c9afecdbc33f4790792f0d712dbf7523790a92dcfbe8fb5cf4c2d282fc5b?repository_url=registry.redhat.io/rhaii/vllm-neuron-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhaii/vllm-rocm-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-rocm-rhel9@sha256:1a30359d6ca5d0891e403b9b0a23c0ae1ad6e30a2429b9b42e246b874fe8859a?repository_url=registry.redhat.io/rhaii/vllm-rocm-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhaii/vllm-spyre-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-spyre-rhel9@sha256:11ad6e13c41728944d933c7abe01d1d10ecb3f8e8b4f0da50ec53b7df6f036a8?repository_url=registry.redhat.io/rhaii/vllm-spyre-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhaii/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-tpu-rhel9@sha256:0c2ac747d67dc0e80162ff05867dd702e474b2217659f19f28b8e3a0c03a942a?repository_url=registry.redhat.io/rhaii/vllm-tpu-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhaiis/vllm-cpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cpu-rhel9@sha256:fb7791bbfea99e9f81529fe8cc1e7c834ca470585c27590e3d0a6834167cd436?repository_url=registry.redhat.io/rhaiis/vllm-cpu-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhaiis/vllm-cuda-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cuda-rhel9@sha256:73bbc4560132c4aaa9bbd608ce9560eeae7b30bcc8f014da460afa5622139372?repository_url=registry.redhat.io/rhaiis/vllm-cuda-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhaiis/vllm-neuron-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-neuron-rhel9@sha256:8ba72cec5d79b1a751eb09774c81fd6181b43ec69a2e5116982661b34366874d?repository_url=registry.redhat.io/rhaiis/vllm-neuron-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhaiis/vllm-rocm-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-rocm-rhel9@sha256:37b64a8df90756aae0ee96d2f07765adbce5ed5beb2414ac3845806ad2219cfc?repository_url=registry.redhat.io/rhaiis/vllm-rocm-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhaiis/vllm-spyre-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-spyre-rhel9@sha256:3dd7eff1c62cd4609b4c76590b77bb801cd064e40642ed32b5aa900a6bc643ea?repository_url=registry.redhat.io/rhaiis/vllm-spyre-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhaiis/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-tpu-rhel9@sha256:b1c12112a1e8a298645e10d34d44c9961a6121aa8d87fc5d65ad83e1ffa3c586?repository_url=registry.redhat.io/rhaiis/vllm-tpu-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhelai3/bootc-aws-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-aws-cuda-rhel9@sha256:a754d4d1126e98f203249414b3831182bb15ee6b3643452f167849defc642e4b?repository_url=registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhelai3/bootc-azure-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-azure-cuda-rhel9@sha256:df5b6edd1bdb055219a7385b6d5923f3262c3a408f92da734e3027af55fd593f?repository_url=registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhelai3/bootc-azure-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-azure-rocm-rhel9@sha256:8ea1233b1fb6b82d0aa69e9e4c47d2df242001280c11a61584066c27c5bec3a5?repository_url=registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-cuda-rhel9@sha256:b45f3bc25a7d3c9f3bfdc1de3be6db59f6c3109f62326d74fae14e832a797981?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhelai3/bootc-gaudi-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-gaudi-rhel9@sha256:e1057b59ca1be9501332abf97230855e85c7df858356be0da9dce230ea7e98e1?repository_url=registry.redhat.io/rhelai3/bootc-gaudi-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhelai3/bootc-gcp-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-gcp-cuda-rhel9@sha256:bac5d435d156c3ddcb581d3ff05fdce9f72bd617c5b8435cede16bb17b7bf12e?repository_url=registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhelai3/bootc-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-rocm-rhel9@sha256:38ce057f97034bbb8eaea574d41cc7eebaeaa9265a4cdd966476dd3fac129c3c?repository_url=registry.redhat.io/rhelai3/bootc-rocm-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhoai/odh-kserve-agent-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-agent-rhel9@sha256:eddf436baf8906d08f1cd28fecdc73f70f9bbf11a73e327d9c97495ee921c523?repository_url=registry.redhat.io/rhoai/odh-kserve-agent-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhoai/odh-kserve-controller-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-controller-rhel9@sha256:8b4d4c6a45b2ff1b25fda45dc022066ed5d055267ce08ab0b31e58191970632e?repository_url=registry.redhat.io/rhoai/odh-kserve-controller-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhoai/odh-kserve-router-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-router-rhel9@sha256:1fb5c0b39c43904a5843a9e01cddac40cfe5580d9bb7abdf6083c9f53d1655b3?repository_url=registry.redhat.io/rhoai/odh-kserve-router-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhoai/odh-kserve-storage-initializer-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-storage-initializer-rhel9@sha256:7c88948bcfa0fc3439b1eae31c426639346044505aff440238bfb194fd15ce99?repository_url=registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhoai/odh-llm-d-kv-cache-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-llm-d-kv-cache-rhel9@sha256:cb5eedeefd2578cd9bd8637250bbe299c84539f57b4ead75d630ed9f833a6ef2?repository_url=registry.redhat.io/rhoai/odh-llm-d-kv-cache-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhoai/odh-th-torch-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-th-torch-cuda-py312-rhel9@sha256:efd7b3607b699092c68359d20ef0d0043114191a097637667c0d2cf78fbea702?repository_url=registry.redhat.io/rhoai/odh-th-torch-cuda-py312-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00
  • rhoai/odh-vllm-gaudi-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-vllm-gaudi-rhel9@sha256:87eec3862eb6ddef445f89dcf6fd89add7ef202ea7c563b1ee7347537fb3e250?repository_url=registry.redhat.io/rhoai/odh-vllm-gaudi-rhel9

    • workaround: Avoid exposing these apis (/v1/completions and /v1/chat/completions) anonymously. Keeping the APIs behind API keys and authenticated clients is good.
    • none available: Fix deferred
    Red Hat · CVE-2026-100654 · Updated 2026-10-01T17:34:13+00:00

Known Affected Software Configurations

VendorProductVersion range
VllmVllm< 0.29.0

All CVSS metrics

  • HIGH 7.1 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • MEDIUM 6.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • HIGH 7.1 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • MEDIUM 6.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS