CVE-2026-93989: vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words
vLLM through 0.29.0 fails to properly validate badwords token indices against the model's generation output width in SamplingParams.updatefromtokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests to return incorrect tokens.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vLLMto a version that resolves this vulnerability.Fixed in 0.29.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access to a vLLM service and low-privilege access sufficient to submit requests with crafted bad_words token indices. Exploitation also depends on concurrent in-flight HTTP requests, because the corruption affects another request's logits memory.
What is the observable impact of successful exploitation?
Concurrent HTTP requests can return incorrect generated tokens. The provided impact information indicates integrity impact only; it does not indicate confidentiality or availability impact.
Which versions are affected?
vLLM through version 0.29.0 is affected. The supplied data does not identify a fixed release version.