A flaw was found in vLLM. This vulnerability arises from incorrect validation of `allowed_token_ids` against the tokenizer length instead of the model's output logits width. A remote attacker can exploit this by supplying token IDs that exceed the output vocabulary, which bypasses validation. This can lead to the corruption of the GPU logits state, potentially allowing concurrent requests to sample tokens outside their intended allowlists, resulting in information disclosure.
Last checked: 2026-09-28 20:49 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-21 18:29 UTC)
Fix evidence last checked: 2026-09-28 19:04 UTC