CVE-2026-93989: vLLM Token Index Validation Flaw Leading to Logits Memory Corruption
Summary
CVE-2026-93989: vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Affects vllm versions < 0.30.0. Fixed in 0.30.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vLLM is an open-source library designed for efficient language model serving, providing capabilities for generating text based on input prompts. It is widely used in applications that require natural language processing. However, versions up to 0.29.0 are vulnerable to a critical issue where improper validation of token indices can lead to memory corruption, affecting the integrity of concurrent requests.
Vulnerability Detail
The vulnerability in vLLM arises from the failure to properly validate 'bad_words' token indices against the model's generation output width in the SamplingParams.update_from_tokenizer() function. This oversight allows attackers to supply out-of-bounds token indices, which can corrupt the logits memory of concurrent requests. As a result, different in-flight HTTP requests may return incorrect tokens, potentially leading to unexpected behavior or data leakage.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "vllm==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.30.0
This is the first release that contains the fix.
pip install --upgrade "vllm==0.30.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation on the token indices before passing them to the vLLM functions. Ensure that all token indices are within the valid range of the model's output width to prevent out-of-bounds errors.
Conclusion
The vLLM package has a critical vulnerability (CVE-2026-93989) that can lead to memory corruption due to improper validation of token indices. Users are strongly advised to update to version 0.30.0 or later to mitigate this risk. For those unable to upgrade immediately, implementing input validation can serve as a temporary measure.
See every vulnerability recorded for vllm →
FAQ
CVE-2026-93989 is a vulnerability in the vLLM package that allows attackers to exploit improper validation of token indices, leading to potential memory corruption.
Versions of vLLM up to and including 0.29.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is impacted by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
If upgrading is not possible, implement input validation on token indices to ensure they remain within the valid range, as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for vllm.
