GHSA-q97c-p368-75c4 vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

• PyPI vllm: < 0.32.0 → fixed in 0.32.0

For a model whose vocabulary size is an exact multiple of the embedding padding size (64) — e.g. any Llama-2-family model, vocab 32000 — a single request carrying a pre-tokenized prompt with token id equal to the vocab size (32000) passes vLLM's input-id validation but is one past the last embedding row. At tensor-parallel size 1 the embedding lookup does not mask indices, so the id reaches `F.embedding` out of range and raises a CUDA device-side assert, which poisons the engine's CUDA context and takes the engine down. Any client that can send pre-tokenized input (`/v1/completions` with `prompt` as token ids, `/tokenize`-fed flows, or the `kv_transfer_params["prompt_token_ids"]` reuse path) can trigger it. Root cause `vllm/v1/engine/input_processor.py` accepts a token id when `id 1 masks via `get_masked_input_and_mask`, so the id is clamped, not an OOB — likely wrong output rather than a crash. • Models whose vocab is a multiple of 64 with `tokenizer.vocab_size` one past the max real id (Llama-2 family, vocab 32000, is the clear case). Qwen2.5 is NOT affected (padded headroom). Suggested fix max_token_id in vllm/tokenizers/hf.py now uses tokenizer.vocab_size - 1, so an id equal to the vocabulary size fails input validation instead of reaching the embedding. Fixed in MR59491, released in v0.32.0. Reporter Shijie Lyu (GitHub shijie-lyu [email protected]). Reported privately per SECURITY. This advisory was fixed in MR59491.