7 matches found
CVE-2026-93840
A flaw was found in vLLM. This vulnerability arises from incorrect validation of allowedtokenids against the tokenizer length instead of the model's output logits width. A remote attacker can exploit this by supplying token IDs that exceed the output vocabulary, which bypasses validation. This ca...
SUSE CVE-2026-93840
vLLM before 0.29.0 validates allowedtokenids against tokenizer length instead of model output logits width in SamplingParams.validateallowedtokenids. Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow...
PYSEC-2026-3998
vLLM before 0.29.0 validates allowedtokenids against tokenizer length instead of model output logits width in SamplingParams.validateallowedtokenids. Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow...
PYSEC-0000-CVE-2026-93840
vLLM before 0.29.0 validates allowedtokenids against tokenizer length instead of model output logits width in SamplingParams.validateallowedtokenids. Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow...
EUVD-2026-83284
vLLM before 0.29.0 validates allowedtokenids against tokenizer length instead of model output logits width in SamplingParams.validateallowedtokenids. Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow...
PT-2026-102784
vLLM before 0.29.0 validates allowed token ids against tokenizer length instead of model output logits width in SamplingParams. validate allowed token ids. Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow...
CVE-2026-93840: Improper Validation of Array Index
vLLM before 0.29.0 validates allowedtokenids against tokenizer length instead of model output logits width in SamplingParams.validateallowedtokenids. Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow...