vLLM — unauthenticated engine crash via negative token IDs in embeddings/pooling endpoints (GPU context poisoning)

A single unauthenticated network request with a crafted negative token ID to vLLM's embeddings/pooling API triggers a fatal CUDA assertion, poisoning the shared GPU context and denying service to every other request on that inference instance.

This is a trivially exploitable, single-request unauthenticated DoS against a widely-deployed inference engine's multi-tenant GPU context — one malicious request degrades service for all co-located users/tenants until an operator restarts the process, a severe availability risk for any shared vLLM deployment.

vLLM fails to validate the lower bound of token IDs submitted to /v1/embeddings and /pooling endpoints; a single request containing a negative token ID triggers a CUDA device-side assertion that poisons the GPU context, causing all subsequent requests on that engine to fail until the process is restarted.

vLLM before 0.28.0

Upgrade to vLLM 0.28.0 or later per GitHub Security Advisory GHSA-25q3-v2hm-8vpf.