WS-2026-0143

vllm 0.11.1 - 0.17.1: the speculative-decoding rejection sampler sizes its per-request expansion from outputtokenids, which is empty when only allowedtokenids is set, so a request with allowedtokenids crashes the engine worker GHSA-8c65-hq7q-r7jm...