43 matches found
cracken
Cracken Cracken is a fast password wordlist generator, Smartlist creation and password hybrid-mask analysis tool written in pure safe Rust more on talk/talk. Inspired by great tools like maskprocessormp, hashcathashcat, Crunchcrunch and 🤗 HuggingFace's tokenizerstokenizers. What? Why? Woot?? At...
CVE-2026-85670
A flaw was found in the Hugging Face tokenizers library. A remote attacker could provide a specially crafted tokenizer.json file, which, when processed, leads to an out-of-bounds buffer access. This vulnerability can cause the application to terminate, resulting in a denial of service. In certain...
EUVD-2026-110036
vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert engine crash / DoS...
SUSE CVE-2026-115916
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...
PYSEC-2026-4347
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...
CVE-2026-115916
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...
PYSEC-2026-4347
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...
CVE-2026-115916 vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...
CVE-2026-115916 vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...
CVE-2026-115916 vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...
CVE-2026-115916
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes maxtokenid with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...
CVE-2026-115916
The vLLM inference and serving engine (versions prior to 0.32.0 ) is vulnerable to a Denial of Service (DoS) due to an off-by-one error in vllm/tokenizers/hf.py. The max_token_id is calculated with an incorrect upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to bypass...
PT-2026-123448
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.32.0 Description An off-by-one error in the calculation of max token id within vllm/tokenizers/hf.py allows a pre-tokenized prompt ID equal to the vocabulary size to pass validation. When the tensor-parallel size is on...
PT-2026-132750
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max token id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...
vLLM input validation error vulnerability
Versions prior to vLLM 0.32.0 contain a security vulnerability. This vulnerability arises from an off-by-one error in the upper bound calculation of maxtokenid within vllm/tokenizers/hf.py. As a result, pre-tokenized prompt IDs equaling the size of the vocabulary can pass validation. When the...
RHLW-2026-B11ABDA52745AF4C Lightwell Security Advisory: tokenizers 0.23.1+rhlw.1
Red Hat Lightwell has released tokenizers 0.23.1+rhlw.1 with a backported security fix. CVE-2026-85670: tokenizers BpeBuilder Buffer Overflow via merge token This patched artifact is a drop-in replacement for tokenizers 0.23.1 from PyPI...
cracken
Cracken Cracken es un rápido generador de listas de palabras, creador de smartlists y herramienta de análisis de máscaras híbridas para contraseñas, escrito en Rust puro y seguro más información en talk/talk. Inspirado por grandes herramientas como maskprocessormp, hashcathashcat, Crunchcrunch y...
python313-tokenizers-0.23.2-1.1 on GA media (moderate)
python313-tokenizers-0.23.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11936-1 Rating: moderate Cross-References: CVE-2026-93599 CVE-2026-93600 CVE-2026-93601 CVE-2026-93602 CVSS scores: CVE-2026-93599 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-93599 SUSE : 8.7...