EUVD-2026-83617
GHSA-pc5q-2x89-w436
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reachable via inference API (AV:N) but needs a specific multimodal model mismatch plus concurrency (AC:H) and request-submission access (PR:L); impact is integrity-only corruption of outputs (I:L), no disclosure or DoS.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests to return incorrect tokens.
AnalysisAI
Out-of-bounds bad_words token indices in vLLM through 0.29.0 are not validated against the model's generation output width, allowing the indices to be written past the logits buffer and corrupt the sampling state of concurrently batched requests, so unrelated in-flight HTTP requests can receive incorrect output tokens. Exploitation requires API access sufficient to submit sampling requests with a bad_words parameter (authenticated, PR:L), a target model whose tokenizer exposes input-only placeholder tokens with IDs above the model's logits vocabulary (typically multimodal models such as those with <|audio|> tokens), and concurrent requests sharing the batch, so a text-only model whose tokenizer vocabulary equals its output vocabulary is not affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to submit sampling requests (bad_words parameter) to a vLLM inference endpoint (through 0.29.0), and - per the fix's regression tests - a model whose tokenizer contains input-only placeholder tokens (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to a genuinely LOW-priority issue despite the alarming-sounding 'cross-request corruption' description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - the corrective change is in https://github.com/vllm-project/vllm/pull/48824, which validates bad_words IDs against model_config.get_vocab_size() (max valid ID = vocab_size - 1), passes the logits output_width into the BadWords path, and adds a bounds guard before applying a match, so upgrade to a vLLM build that contains this commit (anything released after 0.29.0, since 0.29.0 and earlier are affected) once a tagged release including it is verified. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Vllm versions up to 0.12.0 is affected by allocation of resources without limits or throttling (CVSS 6.5).
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
Race condition in vLLM's prompt embedding loader allows concurrent API requests to bypass the sparse tensor invariant gu
Remote code execution in vLLM 0.10.1 through 0.13.x lets an attacker who controls the model repository or path run arbit
Server-Side Request Forgery in vLLM's multimodal MediaConnector allows remote attackers to coerce the inference server i
Same weakness CWE-129 – Improper Validation of Array Index
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today