CVE-2026-93841: vLLM Memory Corruption Vulnerability in Triton Kernel
Summary
CVE-2026-93841: vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Affects vllm versions < 0.30.0. Fixed in 0.30.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vLLM is an open-source library designed for efficient and scalable language model inference. It leverages advanced techniques to optimize the performance of large language models, making it a popular choice among developers working with natural language processing. However, the library is susceptible to a memory corruption vulnerability that can be exploited under certain conditions, particularly when handling multimodal audio requests.
Vulnerability Detail
The vulnerability in vLLM arises from a flaw in the Triton _bincount_kernel, where prompt token IDs are indexed against a penalty prompt-presence bitset without proper bounds checking against the vocabulary size. This oversight allows attackers to submit requests with token IDs that equal or exceed the vocabulary size, leading to out-of-bounds writes. Such writes can corrupt the sampler state of concurrent requests, potentially altering the repetition penalty behavior and affecting the integrity of the model's output.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "vllm==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.30.0
This is the first release that contains the fix.
pip install --upgrade "vllm==0.30.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid submitting multimodal audio requests with token IDs that are equal to or exceed the vocabulary size until the package is updated.
Conclusion
The vLLM package has a memory corruption vulnerability that can be exploited through specific requests. Users should update to version 0.30.0 to mitigate this risk. For those unable to update immediately, a temporary workaround is available. Regular monitoring for vulnerabilities, such as through Vulert, is recommended to maintain application security.
See every vulnerability recorded for vllm →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to memory corruption, which may alter the behavior of the model and affect the output quality.
Yes, a patch is available in version 0.30.0 of the vLLM package. Users are encouraged to update to this version.
If you cannot update the package right away, avoid using multimodal audio requests with high token IDs as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for vllm.
