EUVD-2026-93430
GHSA-x9pq-jx6q-p3qv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain inference request access to vLLM API
-
DeliveryCraft request mixing prompt_embeds with penalty params
-
ExploitTrigger fault in get_token_bin_counts_and_mask
-
ExecutionCrash inference engine
-
ImpactDenial of service for all users
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Requires the attacker to be able to submit inference requests to a vLLM server (version up to 0.31.0) and to exercise the Penalty Handler code path - specifically a request that supplies prompt_embeds together with token penalty parameters (frequency/presence/repetition), which drives get_token_bin_counts_and_mask in vllm/model_executor/layers/utils.py to crash the engine. The reproduction is remote and needs no user interaction (UI:N) and low complexity (AC:L). Limiting factors: PR:L means the attacker must have request-submission access to the serving endpoint (so risk is highest for internet-exposed or multi-tenant deployments and lower where the API is network-restricted or authenticated), and the prompt_embeds + penalties feature combination must be reachable; impact is limited to availability - no data disclosure or integrity compromise. |
| Impact | Signals are consistent and point to a genuine but moderate (not top-priority) issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates remote, low-complexity exploitation with no user interaction but requiring some privilege (PR:L - ability to submit inference requests), and impact is confined to availability (VA:L; VC:N/VI:N), consistent with CWE-404 improper resource shutdown/release and the 5.3 MEDIUM score. Exploit maturity is E:P (proof-of-concept), matching the POC flag: publicly available exploit code exists, but there is NO CISA KEV listing and NO active-exploitation evidence - do not treat as in-the-wild. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The most important caveat: the vendor was notified via GitHub issue #57719 but has not responded and NO patch is available, so the only mitigations are compensating controls. Net: a real, publicly-exploitable DoS worth prioritizing for internet-exposed or multi-tenant vLLM deployments, but impact is limited to service disruption (no data confidentiality/integrity loss), keeping it a medium-tier concern rather than a critical one. |
| Exploit ScenarioDerived | An actor with the ability to submit inference requests sends a crafted request to a vLLM server that combines prompt_embeds input with penalty parameters (frequency/presence/repetition), reaching the vulnerable get_token_bin_counts_and_mask routine in the Penalty Handler and crashing the engine, denying service to all users. A public proof-of-concept gist (repro_prompt_embeds_penalties_engine_crash.py) already demonstrates the crash, lowering the barrier to exploitation. Because AC:L and UI:N, a single malformed request reliably triggers the condition with no special timing or victim interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Denial of service in vLLM up to and including 0.31.0 lets a remote, authenticated user who can submit inference requests crash the serving engine by combining a prompt_embeds input with token penalty parameters (frequency, presence, or repetition), a combination that drives get_token_bin_counts_and_mask in vllm/model_executor/layers/utils.py into a fault. Publicly available exploit code exists in the form of a published reproduction script, and the vendor had not responded to the early issue report at the time of analysis, so unpatched, internet-exposed or multi-tenant deployments that accept such requests are exposed to availability loss. Impact is limited to availability of the serving process - no data disclosure or integrity compromise has been demonstrated.
RemediationAI
No vendor-released patch identified at time of analysis: the project was notified early via issue 57719 but had not responded, so no fixed version number can be cited and no commit or tagged release is referenced in the intelligence data - track https://github.com/vllm-project/vllm/issues/57719 and the VulDB record https://vuldb.com/vuln/413896 for a fix. Until a patched build ships, the practical mitigation is to cut off the reachable attack surface: require and enforce API authentication (e.g. the server's --api-key option) and restrict the inference endpoints to trusted networks or tenants, accepting the trade-off that anonymous or open-gateway usage is no longer possible; reject or strip requests carrying prompt_embeds alongside frequency/presence/repetition penalty fields at a reverse proxy or request-validation layer in front of the engine, understanding that this breaks legitimate embedding-based prompting workflows; and rate-limit and log such requests so abusive callers can be throttled before they repeatedly kill workers. Because the outcome is a crash rather than corruption, run the server under a supervisor with automatic restart and add health-check/alerting on engine exit so availability is restored quickly, and isolate multi-tenant workloads into separate processes or containers so one crashing engine does not affect other tenants.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in vLLM's Penalty Handler, the component that applies frequency, presence, and repetition penalties to generated tokens, and specifically in the helper get_token_bin_counts_and_mask found in vllm/model_executor/layers/utils.py. That helper builds histogram-style bin counts and an associated boolean mask over token IDs, which presupposes that the request's input is ordinary tokenized text; when a request supplies prompt_embeds (pre-computed embeddings that bypass normal tokenization) alongside token penalty parameters, the data the helper receives no longer satisfies its assumptions and the engine crashes instead of failing gracefully. VulDB classifies the root cause as CWE-404 (Improper Resource Shutdown or Release), i.e. a resource/state handling defect that terminates the process rather than a memory-safety bug, which matches the observed impact of a clean engine crash rather than code execution or memory leakage. Affected product identifiers in the intelligence feed are given as cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:* (wildcard version), and the description bounds the affected range at 0.31.0 and earlier; the underlying defect is reachable purely over the network through the request path, and the CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P supplied by the reporter agrees with that purely availability-oriented, low-severity-impact profile and flags proof-of-concept exploitation (E:P).
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Remote request with no interaction (AV:N/UI:N/AC:L); PR:L because request-submission access is needed; engine crash denies the whole service so A:H, with no C/I impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB