CVE-2026-93840 vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids
Attackers can corrupt GPU logits state to bypass token allowlists in vLLM, potentially leaking sensitive information or altering model outputs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93840?
CVE-2026-93840 is a medium-severity vulnerability in Vllm Vllm, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow concurrent requests to sample tokens outside their allowlists.
Weakness: CWE-129
Which versions are affected by CVE-2026-93840?
1 open source package ship an affected version, including vllm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vllm PyPI | All versions | 0.29.0 |
Products include Vllm Vllm.
How do I fix CVE-2026-93840?
Upgrade vllm to 0.29.0 or later.
Is CVE-2026-93840 being exploited?
There is no known exploitation of CVE-2026-93840 in the wild and no public exploit code.
Other vulnerabilities in Vllm Vllm
- CVE-2025-32444 vLLM Vulnerable to Remote Code Execution via Mooncake Integration
- CVE-2026-22778 vLLM leaks a heap address when PIL throws an error
- CVE-2025-47277 vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
- CVE-2024-11041 Remote Code Execution in vllm-project/vllm
- CVE-2026-48746 vLLM: OpenAI auth bypass
Sources
Also known as GHSA-97fp-7cr2-23qc, MINI-pfhx-p3m9-gvg6, MINI-v2c4-w3fg-5ggq, MINI-x72g-2x97-8x7q, PYSEC-2026-3998.