CVE-2026-93592: vllm Package Token ID Validation Flaw Leading to Engine Crash
Summary
CVE-2026-93592: vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. Affects vllm versions < 0.28.0. Fixed in 0.28.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vllm package is a popular library in the Python ecosystem, primarily used for managing and processing large language models. It provides functionalities for embedding and pooling operations, which are essential for various natural language processing tasks. However, prior to version 0.28.0, vllm had a critical vulnerability that allowed unauthenticated users to exploit the system by submitting invalid token IDs.
Vulnerability Detail
vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints. This oversight allows unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that poisons the GPU context, causing all subsequent requests to fail until the process is restarted. This vulnerability poses a significant risk as it can lead to service disruptions and denial of service.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "vllm==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.28.0
This is the first release that contains the fix.
pip install --upgrade "vllm==0.28.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is recommended to implement input validation on the client side to ensure that only valid token IDs are sent to the /v1/embeddings and /pooling endpoints. This can help prevent negative token IDs from being submitted. Example code for input validation:
if token_id < 0:
raise ValueError('Token ID must be non-negative')
Conclusion
In summary, CVE-2026-93592 is a critical vulnerability in the vllm package that allows for denial of service through the submission of negative token IDs. Users are strongly advised to update to version 0.28.0 or later to mitigate this risk. Additionally, implementing client-side input validation can serve as a temporary workaround.
See every vulnerability recorded for vllm →
FAQ
CVE-2026-93592 is a vulnerability in the vllm package that allows unauthenticated attackers to crash the engine by submitting negative token IDs.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring any signup.
The main consequence is a denial of service, as submitting a negative token ID can poison the GPU context, causing all subsequent requests to fail until the process is restarted.
You can update the vllm package by running the command pip install --upgrade vllm in your terminal.
Yes, implementing input validation on the client side to ensure only valid token IDs are sent can help prevent this issue temporarily.
References
Related vulnerabilities
Recent vulnerabilities recorded for vllm.
