What’s Vulnerable › Vulnerabilities

CVE-2026-93840: vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-18 · updated 2026-09-28
• Weakness: CWE-129

Description

vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow concurrent requests to sample tokens outside their allowlists.

Affected products

• vllm-project vllm: before 0.29.0 — fixed in 0.29.0

How to fix

Upgrade to a fixed version: vllm-project vllm 0.29.0. Check the vendor advisory for mitigations.

References

• https://github.com/vllm-project/vllm
• https://github.com/vllm-project/vllm/blob/v0.28.0/vllm/sampling_params.py#L881-L903
• https://github.com/vllm-project/vllm/blob/v0.28.0/vllm/v1/worker/gpu/sample/logit_bias.py#L179-L191
• https://github.com/vllm-project/vllm/commit/5b0e5b69ac1a3884a6479c9537789c95263cc804
• https://github.com/vllm-project/vllm/pull/49080
• https://www.vulncheck.com/advisories/vllm-before-0.29.0-cross-request-logits-corruption-via-allowed-token-ids

Get alerted when CVE-2026-93840 or the next vulnerability affects your stack