vLLM is a high-throughput inference engine for large language models. In releases prior to 0.24.0, speculative decoding can generate a recovered token equal to the vocabulary size boundary; this value is converted to –1 and passed to the model’s embedding and attention paths, triggering an out-of-bounds assertion and crashing the worker. The crash aborts all concurrent requests, resulting in a service-wide denial of service for any client sharing the worker.

vllm-project vLLM versions earlier than 0.24.0, especially deployments that share a single engine worker across multiple clients; the flaw can be triggered through the public gRPC Generate and Abort endpoints.

With a CVSS score of 7.5, the vulnerability is classified as high severity, but an EPSS score of <1% indicates a very low current exploitation probability and it is not listed in the CISA KEV catalog. An attacker only needs the ability to send generation requests to the exposed gRPC endpoints; no local or privileged access is required. By crafting a specific request sequence that induces speculative decoding, the attacker can cause the shared worker to crash and deny service to all users until a restart occurs.