CVE-2026-115916

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...

CVE-2026-115916

The vLLM inference and serving engine (versions prior to 0.32.0 ) is vulnerable to a Denial of Service (DoS) due to an off-by-one error in vllm/tokenizers/hf.py. The max_token_id is calculated with an incorrect upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to bypass...