vLLM unvalidated out-of-vocabulary stop_token_ids crashes engine and can write out of bounds on GPU

SamplingParams accepted any integer in stop_token_ids and passed the values to the sampler as column indices into the model's logits tensor, without verifying they were within the model vocabulary. An out-of-vocabulary ID can trigger a device-side index error and terminate the engine (V1) or an out-of-bounds Triton store in the V2 runner, potentially corrupting adjacent logits or other GPU state.

It is triggerable via OpenAI chat/completion, legacy generate, and batch endpoints with a single request, allowing a remote caller to crash a shared serving engine or corrupt GPU state (CVSS 6.5).

Submit a request containing an out-of-vocabulary stop_token_ids value to crash the engine or write out of bounds on the GPU.

vLLM >= 0.20.1, < 0.29.0.

Upgrade to vLLM 0.29.0 (PR #54196 validates every stop_token_ids value against the model vocabulary before it reaches the sampler).