CVE-2026-93989

🗓️ 19 Sep 2026 22:58:10Reported by VulnCheckType

vLLM through 0.29.0 cross-request logits corruption via out-of-bounds bad_words token indices.

Reporter	Title	Published	Views	Family All 3
Cvelist	CVE-2026-93989 vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words	19 Sep 202622:58	–	cvelist
EUVD	EUVD-2026-83617	20 Sep 202600:30	–	euvd
NVD	CVE-2026-93989	19 Sep 202623:17	–	nvd

Vulners

CNA

Node

vllm-project vllmRange0–0.29.0

[
  {
    "vendor": "vllm-project",
    "product": "vllm",
    "defaultStatus": "unaffected",
    "packageURL": "pkg:pypi/vllm",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "versionType": "semver",
        "lessThanOrEqual": "0.29.0"
      }
    ],
    "repo": "https://github.com/vllm-project/vllm"
  }
]

Source	Link
github	www.github.com/vllm-project/vllm/blob/98dff2a81d747d1dba01a47f939f48c3526d4206/vllm/v1/worker/gpu/sample/bad_words.py
github	www.github.com/vllm-project/vllm/blob/98dff2a81d747d1dba01a47f939f48c3526d4206/vllm/sampling_params.py
github	www.github.com/vllm-project/vllm
vulncheck	www.vulncheck.com/advisories/vllm-through-0.29.0-cross-request-logits-corruption-via-bad-words
github	www.github.com/vllm-project/vllm/pull/48824

19 Sep 2026 23:17Current

CVSS 42.3

CVSS 3.13.1

CWE-129