vLLM Rust tiktoken tokenizer backend — DoS via crafted vocab file

Narrow-impact DoS in vLLM's tokenizer backend; included for completeness given vLLM's broad deployment footprint, but the local-access requirement substantially limits real-world blast radius versus the network-reachable vLLM DoS advisories already tracked.

TiktokenTokenizer::new in the Rust tiktoken vocab file handler (rust/src/text/src/backend/hf/mod.rs) can be driven into a denial-of-service condition; exploitation requires local access per the CNA record (CVSS 3.3 LOW).

vllm-project vLLM up to 0.29.0

Track the linked gist/upstream vLLM repository for a fix; low practical risk given local-access precondition.