EUVD-2026-77463
GHSA-hvv2-qg7m-ffqp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege local OS access
-
DeliveryWrite crafted .tiktoken file with duplicate ranks
-
ExploitSupply malicious file path to vLLM tokenizer config
-
ExecutionvLLM loads file via TiktokenTokenizer::new()
-
PersistRust panic kills vLLM process
-
ImpactService DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Exploitation requires local access to the host running vLLM and the ability to supply a crafted tiktoken vocabulary file path that the vLLM process will attempt to load - either by writing to a directory from which vLLM reads tokenizer configs, or by influencing the tokenizer file path through a vLLM configuration mechanism accessible to the attacker. The attacker must have PR:L (low-privilege) local OS access. Exploitation is limited to configurations where the Rust tiktoken tokenizer backend is active (as opposed to the Python fallback). Remote network access alone is insufficient; an authenticated vLLM API user who cannot also write files to the server filesystem cannot trigger this flaw via the API. |
| Impact | The CVSS 4.0 score of 1.9 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) accurately reflects the constrained threat model: exploitation requires local system access and the ability to supply or manipulate a tiktoken vocab file path consumed by vLLM. There is no network attack surface, no confidentiality or integrity impact, and the availability impact is limited to a single process crash. A public PoC exists (E:P in the CVSS 4.0 supplemental vector), but the low severity and local-only vector mean exploitation probability is inherently bounded - the attacker must already be on the machine and able to influence tokenizer inputs. This is not a priority remediation item for most deployments; the primary risk is in multi-tenant or shared-inference environments where less-trusted local users can influence model/tokenizer configuration. No CISA KEV listing; EPSS data not provided but expected to be very low given AV:L and low impact. |
| Exploit ScenarioDerived | A local user on a shared vLLM inference server crafts a .tiktoken vocabulary file containing two lines with the same rank value (e.g., 'AA 0' and 'AQ 0') and supplies its path to the vLLM tokenizer configuration. When vLLM loads the tokenizer via TiktokenTokenizer::new(), the Rust process panics and terminates, causing a service outage. A working PoC demonstrating exactly this scenario is publicly available at https://gist.github.com/Yunzez/4b08ec3568a8cbfb120062e2558382b8. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Denial-of-service in vLLM's Rust-based tiktoken tokenizer allows a local low-privileged attacker to crash the vLLM process by supplying a crafted vocab file containing duplicate token ranks. The TiktokenTokenizer::new() function in the Rust tokenizer backend previously panicked unconditionally when parsing a tiktoken file with two tokens sharing the same rank value, rather than returning a graceful error. A public proof-of-concept exploit is available via GitHub Gist; no patch has been merged as the fixing pull request remains open.
RemediationAI
No released patched version is available at time of analysis - the fix exists as an open pull request (https://github.com/vllm-project/vllm/pull/51135) that has not yet been merged or tagged into a release. Monitor the PR for acceptance and upgrade to the first vLLM release that includes this commit once available. As a compensating control, restrict filesystem permissions on tiktoken vocab files so that only the vLLM service account can write them, preventing untrusted local users from substituting malicious files. In multi-tenant deployments, ensure that model/tokenizer configuration paths cannot be influenced by end users via API parameters. If process resilience is required, run vLLM under a supervisor (e.g., systemd with Restart=on-failure) to automatically restart on unexpected panics, though this does not prevent repeated crash-loop DoS. The trade-off of the filesystem permission control is that it may complicate model hot-swapping workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vLLM (CPE: cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*) is a high-throughput LLM inference engine that includes a Rust-based tokenizer backend for tiktoken-format vocabulary files. The vulnerable function TiktokenTokenizer::new() in rust/src/tokenizer/src/tiktoken.rs parses .tiktoken files - line-delimited base64-token/rank pairs - and populates a hash map. Prior to the fix, no deduplication check existed: when two entries shared the same rank integer, the Rust runtime triggered an unhandled panic (unwrap/assert failure), immediately killing the process. CWE-404 (Improper Resource Shutdown or Release) is assigned, though the root cause is more precisely a reachable panic condition (closer to CWE-617) caused by missing input validation on the rank uniqueness invariant.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Local-only attack via controlled vocab file, low privilege required, only availability (process crash) impacted, no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/src/backend/hf/mod.rs of the component tiktoken vocab File Handler. The manipulation results in denial of service. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB