CVE-2026-93840 - vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids
Brief
CVE ID : CVE-2026-93840
Published : Sept. 18, 2026, 8:17 p. m.
- 38 minutes ago
Description : vLLM before 0.
- 0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams. _validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow concurrent requests to sample tokens outside their allowlists.
Severity: 6.3
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...