EUVD-2026-83617

vLLM through 0.29.0 fails to properly validate badwords token indices against the model's generation output width in SamplingParams.updatefromtokenizer. Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests to...

CVE-2026-93989

vLLM through 0.29.0 is affected by a validation flaw in SamplingParams.update_from_tokenizer(). The function fails to properly validate bad_words token indices against the model's generation output width, allowing attackers to supply out-of-bounds indices that corrupt the logits memory of concurr...