MediumVulnerabilityCVE-2026-115916updated 28 Oct 2026, 21:15 UTC

vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

Fixed in vllm 0.32.0Official source

Severity	MediumCVSS 6.5 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yesvllm 0.32.0 · since 28 Oct 2026
How sure is this?	Official sourceBacked by an official source

Are you affected?

Package / product	Affected versions	Fixed in
vllm · pip	< 0.32.0	0.32.0

Timeline

28 Oct 2026, 21:15 UTC
Publicly disclosed
28 Oct 2026, 21:15 UTC
Reported by GitHub Advisory · GitHub Advisory
28 Oct 2026, 21:15 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)GitHub Advisory · 28 Oct 2026, 21:15 UTC

Technical details

ID: CVE-2026-115916 · GHSA-q97c-p368-75c4
CVSS: 6.5 / 10
EPSS: 0.3% chance of exploitation within 30 days
Disclosed: 28 Oct 2026, 21:15 UTC
On Zero Radar: 28 Oct 2026, 21:15 UTC (1 min after disclosure)
Last change: 28 Oct 2026, 21:15 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) · Zero Radar