PYSEC-2026-3998

vLLM before 0.29.0 validates allowedtokenids against tokenizer length instead of model output logits width in SamplingParams.validateallowedtokenids. Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow...

PT-2026-95639

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.0 Description The SamplingParams. validate allowed token ids function validates allowed token ids against the tokenizer length rather than the model output logits width. This allows attackers to provide token IDs th...