Description
vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow concurrent requests to sample tokens outside their allowlists.
Affected products
vllm: vllm
References6
- github.com/vllm-project/vllm/commit/5b0e5b69ac1a3884a6479c95377… Patch
- github.com/vllm-project/vllm/pull/49080 Issue TrackingPatch
- github.com/vllm-project/vllm Product
- github.com/vllm-project/vllm/blob/v0.28.0/vllm/sampling_params.… Product
- github.com/vllm-project/vllm/blob/v0.28.0/vllm/v1/worker/gpu/sa… Product
- www.vulncheck.com/advisories/vllm-before-0.29.0-cross-request-l… Third Party Advisory
Metrics
- CVSS 3.1
-
5.3
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 4.0
-
6.3
MEDIUM
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 16 · as of 8 November 2026
- CWE
- CWE-129
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.