{"data":{"id":"50b9d604-2ba5-4d0b-a5ad-a5d951da9799","title":"CVE-2026-93841: vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs…","summary":"vLLM through 0.29.0 has a memory corruption flaw in the Triton _bincount_kernel. Prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. An attacker can submit multimodal audio requests with tokens equal to vocabulary size, causing out-of-bounds writes that corrupt concurrent requests' sampler state and alter repetition penalty behavior.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93841","publishedAt":"2026-09-18T20:17:34.357Z","cveId":"CVE-2026-93841","cweIds":["CWE-129"],"cvssScore":"3.7","cvssSeverity":"low","severity":"low","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM memory corruption in Triton _bincount_kernel via prompt token IDs","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00237,"epssCheckedAt":"2026-11-04T06:10:14.827Z","kevDateAdded":null,"advisoryAliases":["GHSA-q9hm-g73w-q6wp"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-01T00:10:38.566Z","patchAvailable":null,"disclosureDate":"2026-09-18T20:17:34.357Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}