vLLM fixes five flaws, four that crash the serving engine

What happened

Four vLLM advisories published on 26 September 2026 and a fifth on 30 September cover the open-source inference server. Out-of-vocabulary stop_token_ids sent with min_tokens above zero trip a CUDA indexing assertion that leaves EngineCore in a fatal state until restart (CVE-2026-100654, CVSS 3.1 6.5, and CVE-2026-100652 in the Rust HTTP and gRPC front ends, 5.9), and an overlong multimodal prompt on the disaggregated /inference/v1/generate endpoint skips the length check (CVE-2026-100651, 6.5). CVE-2026-100653 (6.5) is the supply-chain entry: FunAudioChat and Tarsier2 ignored an operator's --revision pin for some Hugging Face downloads, so a pinned deployment could still load processor, tokenizer and config files from the repository's default branch.

vLLM 0.29.0, released on 9 September, fixes CVE-2026-100651, CVE-2026-100653 and CVE-2026-100654; CVE-2026-100652 affects 0.22.0 to 0.23.0 only. CVE-2026-103241, a denial of service in the Gemma 4 output parser through 0.26.0 scored 5.3, names 0.29.1rc0 as the fix, and that commit first shipped in a stable release in vLLM 0.30.0 on 22 September. The batch follows the nine vLLM flaws of 18 to 21 September on this board.