What happened
LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates the backing int32 tensor with torch.empty(), leaving it uninitialized. When the model runner fills logprobs for a request whose prefix is reported as externally computed by a KVConnectorBase_V1 subclass, positions [0..num_computed_tokens-1] are never written, and downstream tokenizer.decode() hits garbage int32 values and raises OverflowError, which propagates out of EngineCore and kills the engine.
Why it matters
A single API request with prompt_logprobs (or logprobs + echo=true) against a connector-cached prefix is enough to crash EngineCore and drop every in-flight request on that engine, including co-tenant traffic—cross-tenant and repeatable as a kill-loop. Real exposure is highest for lm-eval-harness multiple-choice workloads (MMLU/ARC/HellaSwag/BBH/PIQA) against vLLM + LMCache (CVSS 7.7).
Attack vector
Send a request with prompt_logprobs set against a connector-cached prefix to crash the shared engine and drop co-tenant traffic.
Affected systems
vLLM >= 0.8.5, < 0.31.0 (V1 engine with a KV connector).
Mitigation
Upgrade to vLLM 0.31.0; the fix replaces torch.empty() with zero-initialized token IDs and -inf logprobs in LogprobsTensors.empty_cpu().