CVE-2026-93592: vLLM crash via negative token IDs in /v1/embeddings and /pooling endpoints

Summary

vLLM versions before 0.28.0 do not validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints. An unauthenticated attacker can crash the engine by submitting a negative token ID, which triggers a CUDA device-side assertion that poisons the GPU context and makes all later requests fail until the process restarts.

Mitigation

Fixed in vLLM 0.28.0. The source does not state an upgrade path or workaround beyond this version.

Topics

• Inference infrastructure

Related items

• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence
• InfoThe Blind Spots of Detection: Adversarial Perturbation Attacks against Watchdogs in Distributed LLM InferenceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• HighCVE-2026-118761: Kubeflow Pipelines decompression bomb in pipeline archive uploadSimilar attack · NVD/CVE Database
• LowOpenCode User Hit with Hostile Backlash After Reporting Free AI LoopholeSimilar attack · Socket Blog