EUVD-2026-87746
GHSA-gxcm-7c4h-f56c
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable frontend with no auth in default config (AV:N/PR:N); AC:H because it needs the specific min_tokens>0 plus OOV stop_token_ids combination; availability-only crash so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
6Blast Radius
ecosystem impact- 1 pypi packages depend on vllm (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.22.0.
DescriptionCVE.org
vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids to trigger CUDA tensor indexing failures that leave EngineCore in a fatal state requiring service restart.
Articles & Coverage 1
AnalysisAI
Out-of-vocabulary stop_token_ids in vLLM 0.22.0 through 0.23.0 cause a CUDA tensor indexing failure that drives EngineCore into a fatal state and forces a manual service restart. The trigger is a generation request that simultaneously sets min_tokens greater than zero and includes stop_token_ids outside the model's vocabulary bounds, slipping past missing validation in the Rust HTTP and gRPC frontends to reach MinTokensLogitsProcessor; CVSS 4.0 scores this 8.2, but the assessed impact is availability-only (C:N/I:N/A:H) and deployments enabling vLLM's optional API-key authentication would require a valid key, so real-world severity is lower than the headline score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker able to send generation requests to the Rust HTTP or gRPC frontend of vLLM 0.22.0 through 0.23.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but limited-severity availability issue, not a top priority despite the 8.2 CVSS 4.0 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status is 'Patch available per vendor advisory': GitHub Security Advisory GHSA-qff2-492f-9fm4 (https://github.com/vllm-project/vllm/security/advisories/GHSA-qff2-492f-9fm4) documents the fix, and ENISA EUVD-2026-87746 lists the affected range as 0.22.0 <0.24.0, indicating remediation is delivered after the 0.23.0 line; because no exact fixed version number is confirmed in this dataset, upgrade to the vendor-recommended release from that advisory rather than assuming a specific tag. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all vLLM deployments to identify instances running versions 0.22.0 through 0.23.0 and enable API-key authentication on any exposed services to limit unauthorized triggering. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-20 – Improper Input Validation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today