CVE-2026-93989: Improper Validation of Array Index in vllm-project vllm
vLLM versions up to 0.29.0 have an improper validation vulnerability in the SamplingParams.update_from_tokenizer() function. This flaw allows attackers to supply out-of-bounds bad_words token indices, which can corrupt the logits memory of concurrent requests. As a result, different simultaneous HTTP requests may return incorrect tokens. The vulnerability has a low severity score and no known exploits in the wild.
AI Analysis
Technical Summary
CVE-2026-93989 describes a vulnerability in vLLM (up to version 0.29.0) where the function SamplingParams.update_from_tokenizer() does not properly validate bad_words token indices against the model's generation output width. Attackers can provide out-of-bounds token indices that corrupt the logits memory used by concurrent requests, leading to incorrect token outputs being returned for different in-flight HTTP requests.
Potential Impact
The impact is limited to the corruption of logits memory for concurrent requests, causing incorrect tokens to be returned in HTTP responses. This could affect the integrity of generated outputs but does not indicate privilege escalation, data leakage, or denial of service. The CVSS score is low (2.3), reflecting limited impact and attack complexity.
Mitigation Recommendations
No explicit patch or remediation is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about untrusted input to the bad_words token indices parameter and consider isolating concurrent requests if possible.
CVE-2026-93989: Improper Validation of Array Index in vllm-project vllm
Description
vLLM versions up to 0.29.0 have an improper validation vulnerability in the SamplingParams.update_from_tokenizer() function. This flaw allows attackers to supply out-of-bounds bad_words token indices, which can corrupt the logits memory of concurrent requests. As a result, different simultaneous HTTP requests may return incorrect tokens. The vulnerability has a low severity score and no known exploits in the wild.
CVSS v4.0
Score 2.3low
Affected software
vllm-project
vllm
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-93989 describes a vulnerability in vLLM (up to version 0.29.0) where the function SamplingParams.update_from_tokenizer() does not properly validate bad_words token indices against the model's generation output width. Attackers can provide out-of-bounds token indices that corrupt the logits memory used by concurrent requests, leading to incorrect token outputs being returned for different in-flight HTTP requests.
Potential Impact
The impact is limited to the corruption of logits memory for concurrent requests, causing incorrect tokens to be returned in HTTP responses. This could affect the integrity of generated outputs but does not indicate privilege escalation, data leakage, or denial of service. The CVSS score is low (2.3), reflecting limited impact and attack complexity.
Mitigation Recommendations
No explicit patch or remediation is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about untrusted input to the bad_words token indices parameter and consider isolating concurrent requests if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-19T10:55:49.093Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aaf341655bf5e2cf5588791
Added to database: 09/20/2026, 01:17:10 UTC
Last enriched: 09/20/2026, 01:31:44 UTC
Last updated: 09/20/2026, 04:02:48 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.