CVE-2026-93989 vllm-project CVE debrief

Who should care

Defenders responsible for systems utilizing the vLLM library, especially those handling concurrent requests, should assess their exposure and prioritize verification and potential updates.

Why it matters

CVE-2026-93989 is a low-severity vulnerability in vLLM that can cause logits corruption and incorrect token returns in concurrent requests. Defenders should verify their vLLM version, assess exposure, and consider updates to prevent potential issues.

• Potential for incorrect tokens being returned in HTTP requests
• Corruption of logits memory in concurrent requests
• Need for verification of vLLM version and exposure
• Possible impact on AI model reliability and security

Technical summary

The vLLM library through version 0.29.0 is vulnerable to a logits corruption issue. The SamplingParams.update_from_tokenizer() method fails to properly validate bad_words token indices against the model's generation output width. This allows attackers to provide out-of-bounds token indices, which can corrupt the logits memory of concurrent requests. As a result, different in-flight HTTP requests may return incorrect tokens.

Defensive priority

Defenders should prioritize verifying the version of vLLM in use and assessing the exposure of systems that utilize this library, especially those handling concurrent requests.

Recommended defensive actions

• Verify the version of vLLM in use and assess exposure
• Review and update vLLM to a version beyond 0.29.0 if available
• Monitor for and restrict out-of-bounds token indices in requests
• Implement additional logging and monitoring for suspicious activity
• Perform a thorough review of system configurations for potential vulnerabilities
• Conduct regular security audits to identify and address weaknesses
• Keep track of changes to the vLLM library and its dependencies

Evidence notes

The vulnerability details are based on information from the CVE Program and the National Vulnerability Database (NVD). The source provided limited information about the versions affected, exploitation, or specific impacts beyond the technical description.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.