CVE-2026-100652

vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...

CVE-2026-100652

A flaw was found in vLLM. A remote attacker can trigger a Denial of Service DoS by sending requests containing stop token identifiers that exceed the supported vocabulary limits. Because the application's service frontends fail to properly validate these identifiers before internal processing, th...

EUVD-2026-87746

vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...

CVE-2026-100652 vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids

vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...

CVE-2026-100652

vLLM versions 0.22.0 through 0.23.0 fail to validate stoptokenids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with mintokens greater than zero and out-of-vocabulary stoptokenids to...

Astra Linux – Vulnerability in Apache Log4j2

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters prohibited by the XML 1.0 standard, resulting in malformed XML output. Compatible XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log...

Elastic APM Server security vulnerabilities

Elastic APM Server is a lightweight Agent from the Dutch company Elastic. A security vulnerability exists in Elastic APM Server that stems from a partially failed indexing request leading to the disclosure of sensitive information...

PT-2024-1696

Name of the Vulnerable Software and Affected Versions Elastic APM Server versions prior to 8.12.1 Description An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed, and that response would contain parts of t...