vllm: Unvalidated stop_token_ids causes engine crash (DoS) and out-of-bounds GPU write

Summary

stop_token_ids supplied in a request were checked only to ensure they were integers, not that they were within the model vocabulary. An out-of-vocabulary ID could reach logits indexing: the default V1 runner could assert and terminate the engine, while the V2 runner could write outside the logits buffer.

The report confirmed the issue on vLLM 0.20.1. The validation fix first shipped in v0.29.0.

Details

SamplingParams accepted any integer in stop_token_ids and passed the values to the sampler. The IDs are used as column indices into the model's logits tensor. An invalid value could therefore trigger a device-side index error in the V1 path or an out-of-bounds Triton store in the V2 path.

The affected request paths include OpenAI chat and completion requests. The report also identified the legacy generate endpoint and batch inputs.

Impact

A single request containing an out-of-vocabulary stop token could terminate the engine and interrupt service for other users. On the V2 runner, the same unchecked index could corrupt adjacent logits or other GPU state.

Fix

PR #54196 validates every stop_token_ids value against the model vocabulary before it reaches the sampler. Invalid IDs are rejected as request errors.