CVEvulnerability
CVE-2026-93840
6.3 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-09-18
- Last modified
- 2026-09-28
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 6.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 3.7 LOW — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-129
Description
vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow concurrent requests to sample tokens outside their allowlists.
Affected configurations
• vllm vllm (< 0.29.0)
Related
Weakness · CWE (1)
- CWE-129 Improper Validation of Array Index weakness
References
- https://github.com/vllm-project/vllm Product
- https://github.com/vllm-project/vllm/blob/v0.28.0/vllm/sampling_params.py#L881-L903 Product
- https://github.com/vllm-project/vllm/blob/v0.28.0/vllm/v1/worker/gpu/sample/logit_bias.py#L179-L191 Product
- https://github.com/vllm-project/vllm/commit/5b0e5b69ac1a3884a6479c9537789c95263cc804 Patch
- https://github.com/vllm-project/vllm/pull/49080 Issue Tracking, Patch
- https://www.vulncheck.com/advisories/vllm-before-0.29.0-cross-request-logits-corruption-via-allowed-token-ids Third Party Advisory