Qwertyjack

Improper input validation allows remote attackers to crash the engine or cause a write operation outside the V2 runner's logits buffer. This occurs when out-of-vocabulary `stop token ids` are supplied via OpenAI chat, completion, generate, or batch requests.

The software fails to validate if the values provided in `stop token ids` are within the model vocabulary or logits range, checking only that they are integers. When `min tokens` is greater than 0, these IDs are used as logits indices to suppress stop tokens. An out-of-range ID triggers a CUDA indexing operation (`index put `), leading to a device-side assertion. An authenticated API user can exploit this by sending a malformed request to the 'POST /v1/completions' or 'POST /v1/chat/completions' endpoints, resulting in a 500 Internal Server Error and placing the EngineCore into a fatal state. This causes a denial of service where subsequent requests fail until the service is restarted. Real-world incidents of this issue being exploited have been reported.