CVE-2026-93592: vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints,

vLLM (a tool for running large language models) versions before 0.28.0 have a vulnerability where two endpoints (/v1/embeddings and /pooling) don't properly check if token IDs (numeric identifiers representing words) are valid. An attacker can send a request with a negative token ID to crash the system, and because this triggers a CUDA assertion (an error check on the GPU, the specialized processor used for AI), it corrupts the GPU's state and breaks all future requests until the service restarts.