CVE-2026-93989

vLLM through 0.29.0 is affected by a validation flaw in SamplingParams.update_from_tokenizer(). The function fails to properly validate bad_words token indices against the model's generation output width, allowing attackers to supply out-of-bounds indices that corrupt the logits memory of concurr...