Is CVE-2026-93989 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-93989?

CVE-2026-93989 has a CVSS v3 severity of LOW (3.1).

Back

CVE-2026-93989

Description

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests to return incorrect tokens.