CVE-2026-105922
This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler.
Does this matter?
Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own.
Description
A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- CVSS 4.0
- 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.31% probability · 24th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-404
- Affected
- vllm/vllm
- Source
- cna@vuldb.com
EPSS moved from 0.3% on 7 October 2026 to 0.3% on 26 October 2026.
References
- https://gist.github.com/Yunzez/5c70a3bb328eaf6d646b9d31e879dc4a#file-repro_prompt_embeds_penalties_engine_crash-pyThird Party Advisory
- https://github.com/vllm-project/vllm/Product
- https://github.com/vllm-project/vllm/issues/57719Issue Tracking
- https://vuldb.com/cve/CVE-2026-105922Third Party Advisory
- https://vuldb.com/submit/992707Third Party Advisory
- https://vuldb.com/vuln/413896Third Party Advisory
- https://vuldb.com/vuln/413896/ctiPermissions Required
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.