4 matches found
CVE-2026-116180
vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.emptycpu in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send promptlogprobs...
CVE-2026-116180
The vLLM library (versions 0.8.5 before 0.31.0 ) is vulnerable to a Cross-Tenant Denial of Service (DoS) flaw. The root cause is located in vllm/v1/outputs.py, where LogprobsTensors.empty_cpu() allocates an uninitialized int32 tensor . Because the V1 model runner fails to write to prompt position...
CVE-2026-116180 vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors
vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.emptycpu in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send promptlogprobs...
EUVD-2026-109441
vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.emptycpu in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send promptlogprobs...