CVE-2026-114049

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense that allows remote attackers to constrain other clients' outputs by leaving stale allowedtokenids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycl...

EUVD-2026-107000

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense that allows remote attackers to constrain other clients' outputs by leaving stale allowedtokenids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycl...

CVE-2026-114049

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense that allows remote attackers to constrain other clients' outputs by leaving stale allowedtokenids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycl...

PT-2026-120175

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense that allows remote attackers to constrain other clients' outputs by leaving stale allowed token ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so...