CVE-2026-90713: A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenToke

A security vulnerability (CVE-2026-90713) exists in vLLM (an open-source large language model serving framework) versions up to 0.29.0 in the TiktokenTokenizer function that handles vocabulary files. An attacker with local access to the system can exploit this flaw to cause a denial of service (making the service unavailable), and the exploit code has been publicly released.