vLLM out-of-vocabulary prompt token ids pass input validation and trigger a CUDA device-side assert (engine crash / DoS)

vLLM released a security advisory (CVE-2026-115916): in versions before 0.32.0, an out-of-vocabulary prompt token id could pass input validation and trigger a CUDA device-side assert, causing the inference engine to crash (DoS); fixed in 0.32.0. The root cause is that when the model vocabulary size is exactly an integer multiple of the embedding padding size 64 (e.g., the Llama-2 series, vocabulary 32000), max_token_id is computed as 32000, one greater than the maximum legal id 31999, allowing id 32000 through; with tp=1, the embedding lookup applies no masking, and the out-of-bounds index reaches F.embedding directly. Any client able to send pre-tokenized input (e.g., /v1/completions with token ids as the prompt, or the prompt_token_ids path of kv_transfer_params) can trigger it; with tp>1, the index is clamped by masking, making incorrect output more likely than a crash.