Threats tagged 'pysec-2026-4347'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.5	EPSS 0.3%	CVE-2026-115916Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized Medium6.5EPSS 0.3%2026-10-26GCVE DatabaseCVE-2026-115916 vLLM versions prior to 0.32.0 contain an off-by-one error in the computation of max_token_id in the hf.py tokenizer module. This flaw allows a pre-tokenized prompt ID equal to the vocabulary size to bypass validation. Under specific conditions involving tensor-parallel size and vocabulary size, this leads to a CUDA device-side assertion failure that terminates the engine. The issue is fixed in version 0.32.0. EPSS 0.3%Report on CVE-2026-115916 Vulnerability #pysec-2026-4347 #pypi	GCVE Database	2026-10-26

Page 1 of 1