The vulnerability arises when vLLM does not validate the token indices supplied in the bad_words parameter against the model’s output width during sampling parameter updates. If an attacker provides indices that exceed the logits array bounds, the library writes beyond the allocated buffer, corrupting the logits of other in‑flight API calls. This corruption causes concurrent HTTP requests to return incorrect tokens, compromising the integrity of the model’s responses but not enabling arbitrary code execution.

vLLM versions up to and including 0.29.0, distributed by the vllm‑project, are affected. The issue exists in the sampling_params and bad_words modules of the worker GPU sampling path. No other versions are listed as impacted.

The CVSS score of 2.3 indicates a low severity. The EPSS score of 0.00201 indicates an extremely low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, implying a low likelihood of widespread exploitation. Nonetheless, an attacker can craft a request with malformed bad_words indices to corrupt logits for other concurrent requests. The attack requires only the ability to send a request to the vLLM endpoint; no privilege escalation is needed. The primary risk is to service correctness rather than system compromise.