EUVD-2026-58066Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H for batch-size and hidden-dimension overflow preconditions; UI:R because a co-batched victim user's active request is required; C:H for full cross-user prompt exposure; I:N and A:N as no write or denial-of-service impact exists.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or complete copy of another user's inference result. This issue is fixed in version 0.27.0.
AnalysisAI
Cross-user inference data leakage in vLLM prior to 0.27.0 exposes one batched user's prompt or completion output to another user sharing the same GPU inference batch. The root cause is a 32-bit integer overflow in the CUDA kernel act_and_mul_kernel within activation_kernels.cu, where the pointer arithmetic blockIdx.x * 2 * d wraps around when token indices and hidden-dimension sizes are large enough, redirecting the kernel to read from an adjacent user's input buffer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker and a victim to be simultaneously co-batched on the same vLLM GPU instance - the attacker must be able to submit inference requests to the shared endpoint (no authentication required per CVSS PR:N), and a legitimate victim user's request must be present in the same batch (this co-batching requirement is the basis for CVSS UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N accurately characterizes a network-reachable vulnerability with high confidentiality impact but constrained exploitability due to AC:H - the overflow fires only under specific combinations of batch token index and model hidden dimension, making reliable triggering non-trivial. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to a multi-tenant vLLM inference endpoint submits a sequence of requests timed to share a GPU batch with a concurrent victim user's request. By engineering requests that position their CUDA block index at a value where `blockIdx.x * 2 * d` overflows 32 bits for the deployed model's hidden dimension, the attacker's kernel invocation reads from the victim's input buffer. … |
| Remediation | The definitive fix is to upgrade vLLM to version 0.27.0 or later, which resolves the integer overflow via commit 451227cb3ff07989698fed982c2d3e4300257924 - the fix widens `blockIdx.x` to `int64_t` before pointer arithmetic in all affected kernel functions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Vllm versions up to 0.12.0 is affected by allocation of resources without limits or throttling (CVSS 6.5).
Remote code execution in vLLM 0.10.1 through 0.13.x lets an attacker who controls the model repository or path run arbit
Server-Side Request Forgery in vLLM's multimodal MediaConnector allows remote attackers to coerce the inference server i
Denial of service in vllm 0.19.0's OpenAI-compatible serving path allows remote unauthenticated attackers to exhaust sch
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 9.0)
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today