vLLM calculates the maximum token identifier with an off‑by‑one error, allowing a pre‑tokenized prompt that has an ID equal to the vocabulary size to be considered valid. When the inference engine processes such a prompt in a single‑rank, tensor‑parallel setting with an exact multiple‑of‑64 vocabulary, the embedding layer receives an out‑of‑range ID that triggers a CUDA device‑side assertion, causing the engine to crash. The result is an availability failure that can be repeated by submitting a crafted prompt, leading to a denial‑of‑service condition for the service.

The vulnerability exists in all vLLM releases prior to version 0.32.0. Any deployment that uses the affected tokenization logic and the tensor‑parallel embedding path with a vocab size that is a multiple of 64 is impacted. The product is vLLM, an inference and serving engine for large language models.

The CVSS score of 6.5 indicates a moderate severity for the availability impact. The EPSS score is not available, so the precise likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. The probable attack vector is the submission of a malicious prompt to an inference endpoint that accepts untrusted input, as the off‑by‑one validation flaw can be triggered from the network. No other access or privilege escalation is described, but repeated crashes can disrupt service availability.