PYSEC-2026-3998
At a glance
- Published
- Updated
- CVE
- CVE-2026-93840
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Description
vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow concurrent requests to sample tokens outside their allowlists.
Affected packages
| Package | Versions |
|---|---|
| PyPI · vllm | introduced 0, fixed 0.29.0 |
References
- https://github.com/vllm-project/vllm/blob/v0.28.0/vllm/sampling_params.py#L881-L903 WEB
- https://github.com/vllm-project/vllm/blob/v0.28.0/vllm/v1/worker/gpu/sample/logit_bias.py#L179-L191 WEB
- https://www.vulncheck.com/advisories/vllm-before-0.29.0-cross-request-logits-corruption-via-allowed-token-ids ADVISORY
- https://github.com/vllm-project/vllm/commit/5b0e5b69ac1a3884a6479c9537789c95263cc804 FIX
- https://github.com/vllm-project/vllm/pull/49080 FIX
- https://github.com/vllm-project/vllm PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |