CVE-2026-100654

A flaw was found in vLLM. An authenticated remote attacker can cause a Denial of Service DoS by submitting a completion request containing out-of-range stop token identifiers. Because the service does not verify that user-supplied token identifiers fall within the supported vocabulary range of th...

CVE-2026-100652

A flaw was found in vLLM. A remote attacker can trigger a Denial of Service DoS by sending requests containing stop token identifiers that exceed the supported vocabulary limits. Because the application's service frontends fail to properly validate these identifiers before internal processing, th...