{"schema":"threatline.record/2","record":{"id":"GHSA-w9r6-29q4-pvpr","aliases":["GHSA-w9r6-29q4-pvpr"],"summary":"Unvalidated stop_token_ids causes engine crash (DoS) and out-of-bounds GPU write","details":"### Summary\n\n`stop_token_ids` supplied in a request were checked only to ensure they were integers, not that they were within the model vocabulary. An out-of-vocabulary ID could reach logits indexing: the default V1 runner could assert and terminate the engine, while the V2 runner could write outside the logits buffer.\n\nThe report confirmed the issue on vLLM 0.20.1. The validation fix first shipped in v0.29.0.\n\n### Details\n\n`SamplingParams` accepted any integer in `stop_token_ids` and passed the values to the sampler. The IDs are used as column indices into the model's logits tensor. An invalid value could therefore trigger a device-side index error in the V1 path or an out-of-bounds Triton store in the V2 path.\n\nThe affected request paths include OpenAI chat and completion requests. The report also identified the legacy generate endpoint and batch inputs.\n\n### Impact\n\nA single request containing an out-of-vocabulary stop token could terminate the engine and interrupt service for other users. On the V2 runner, the same unchecked index could corrupt adjacent logits or other GPU state.\n\n### Fix\n\nPR #54196 validates every `stop_token_ids` value against the model vocabulary before it reaches the sampler. Invalid IDs are rejected as request errors.\n","categories":["Unclassified"],"product":"vllm","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-w9r6-29q4-pvpr","source_modified_at":"2026-10-09T08:27:08Z","fetched_at":"2026-10-27T10:24:27.527526Z","package":{"ecosystem":"pip","name":"vllm"},"range":">= 0.20.1, < 0.29.0"}],"fixed_versions":[],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-09T08:27:08Z","modified_at":"2026-10-09T08:27:08Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-w9r6-29q4-pvpr","fetched_at":"2026-10-27T10:24:27.527526Z","source_modified_at":"2026-10-09T08:27:08Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-09T08:27:08Z","content_hash":"9d7d2a6ac4bd5859adab59107e853378f3721426da0feac627b9b9c56ce60e9e"}}