CVE-2026-105922: Denial of Service in vllm-project vLLM

This vulnerability in vllm-project vLLM (versions up to 0.31.0) affects the get_token_bin_counts_and_mask function in the Penalty Handler component (file vllm/model_executor/layers/utils.py). An attacker can remotely manipulate this function to cause a denial of service condition. The vulnerability requires no user interaction and can be exploited with low complexity. The project was notified early but has not provided a fix or response. Public exploit code has been released, increasing the risk of attack.

Successful exploitation results in denial of service, potentially disrupting availability of the vLLM service. The vulnerability can be triggered remotely without authentication or user interaction, increasing its risk. However, the CVSS score of 5.3 indicates a medium severity impact, primarily affecting service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. In the meantime, consider implementing network-level protections to restrict access to the vulnerable component if feasible.