Vulnerability · Published Sep 18, 2026 · Assigned by VulnCheck
CVE-2026-93840vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids
Low 3.7
In plain English
A low-severity security flaw in vllm from vllm-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow concurrent requests to sample tokens outside their allowlists.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | vllm | 0.29.0 | PYSEC-2026-3998 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| vllm-project | vllm | 0 – before 0.29.0 |
Weakness: CWE-129 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://github.com/vllm-project/vllm/pull/49080 patch, issue-tracking
- https://github.com/vllm-project/vllm product
- https://github.com/vllm-project/vllm/commit/5b0e5b69ac1a3884a6479c9537789c95263cc804 patch
- https://github.com/vllm-project/vllm/blob/v0.28.0/vllm/sampling_params.py#L881-L903 technical-description
- https://github.com/vllm-project/vllm/blob/v0.28.0/vllm/v1/worker/gpu/sample/logit_bias.py#L179-L191 technical-description
- VulnCheck Advisory: vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids third-party-advisory