{"data":{"id":"d17c415b-1c45-4aa8-b304-30057ca5133e","title":"CVE-2026-93840: vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in…","summary":"vLLM versions before 0.29.0 validate allowed_token_ids against the tokenizer length instead of the model output logits width, in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass this check, which causes LogitBiasState to corrupt GPU logits state so that concurrent requests can sample tokens outside their allowlists.","solution":"Fixed in 0.29.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93840","publishedAt":"2026-09-18T20:17:34.200Z","cveId":"CVE-2026-93840","cweIds":["CWE-129"],"cvssScore":"3.7","cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM allowed_token_ids validation flaw lets requests sample outside allowlists","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00246,"epssCheckedAt":"2026-11-04T18:09:13.386Z","kevDateAdded":null,"advisoryAliases":["GHSA-97fp-7cr2-23qc"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-01T00:10:38.950Z","patchAvailable":null,"disclosureDate":"2026-09-18T20:17:34.200Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}