Most recent entries from all

EUVD-2026-333675

2026-10-04T15:35:28.938406+00:00

EUVD-2026-333675

fkie_cve-2026-54234

2026-10-04T15:35:28.938451+00:00

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into the drafter's input ids; that out-of-vocabulary value is later consumed by the model's embedding and attention path and crashes the engine worker with a GPU device-side assertion. The same triggering request sequence is reachable through the public gRPC Generate and Abort endpoints, so a remote client that can send generation requests can crash the shared engine worker, aborting concurrent requests and causing a service-wide denial of service for other clients of the deployment until the worker is restarted. This issue is fixed in version 0.24.0.

GHSA-8wr5-jm2h-8r4f — vLLM has Remote DoS via Invalid Recovered Token Reinjection

2026-10-04T15:35:28.938490+00:00

Affected: PyPI: vllm

## Summary

A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to `vocab_size`, convert that value to `-1` when choosing the next live token for a request, and then feed that `-1` back into the next drafter input ids. On Qwen3 GPTQ this reaches the worker-side drafting / attention path and crashes the engine with a GPU `device-side assert`.

The same issue is reachable through the public gRPC request surface by sending a specific overlapping `Generate` / `Abort` sequence.

## Impact

- A remote client that can send public gRPC generation requests can crash the shared vLLM engine worker - The triggering request sequence aborts concurrent requests and prevents later requests from completing until the worker is restarted - In shared deployments, this is a service-wide denial of service for other clients, not just a failure isolated to the attacking requests - The failure is reproducible, so repeated request sequences can sustain the outage

## Affected version

- Confirmed on vLLM `0.17.1` - Earlier and later versions have not been checked yet in this report

## Repro model

- Official Hugging Face repo: - [`Qwen/Qwen3-0.6B-GPTQ-Int8`](https://huggingface.co/Qwen/Qwen3-0.6B-GPTQ-Int8) - Anyone wants to reproduce the bug with my PoC scripts should download `Qwen3-0.6B-GPTQ-Int8` first

## Trigger chain

1. A legal multi-request speculative workload keeps structured-output state, speculative decoding,…

PYSEC-2026-3542 — vLLM has Remote DoS via Invalid Recovered Token Reinjection

2026-10-04T15:35:28.938564+00:00

Affected: PyPI: vllm

## Summary

The same issue is reachable through the public gRPC request surface by sending a specific overlapping `Generate` / `Abort` sequence.

## Impact

## Affected version

- Confirmed on vLLM `0.17.1` - Earlier and later versions have not been checked yet in this report

## Repro model

## Trigger chain

1. A legal multi-request speculative workload keeps structured-output state, speculative decoding,…

RHSA-2026:60363 — Red Hat Security Advisory: Red Hat AI Inference Server 3.3.6 (Spyre)

2026-10-04T15:35:28.938632+00:00

vllm: vLLM: Denial of Service via malformed multimodal input or token injection vllm: vLLM: Supply-chain integrity issue due to inconsistent revision pinning controls vllm: vLLM: Information disclosure via integer truncation vllm: vLLM: Denial of Service via malformed speculative decoding workload vllm: vLLM: Denial of Service via adversarial regular expression in structured outputs API

WID-SEC-W-2026-2176 — vllm: Mehrere Schwachstellen ermöglichen Denial of Service

2026-10-04T15:35:28.938658+00:00

Ein Angreifer kann mehrere Schwachstellen in vllm ausnutzen, um einen Denial of Service Angriff durchzuführen.