vLLM is a high-throughput inference engine for large language models. In releases prior to 0.24.0, a frontend‑legal multi‑request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to –1 when the engine selects the next live token for a request and is written back into the drafter’s input ids; that out‑of‑vocabulary value is later consumed by the model’s embedding and attention path and crashes the engine worker with a GPU device‑side assertion. The crash aborts all concurrent requests, resulting in a service‑wide denial of service for any client sharing the worker.

vllm-project vLLM versions earlier than 0.24.0, especially deployments that share a single engine worker across multiple clients; the flaw can be triggered through the public gRPC Generate and Abort endpoints.

With a CVSS score of 7.5, the vulnerability is classified as high severity, but an EPSS score of <1% indicates a very low current exploitation probability and it is not listed in the CISA KEV catalog. An attacker only needs the ability to send generation requests to the exposed gRPC endpoints; no local or privileged access is required. By crafting a specific request sequence that induces speculative decoding, the attacker can cause the shared worker to crash and deny service.