CVE-2026-105922CWE-404

CVE-2026-105922

Medium · published October 6, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
22.7
In the wild
Unconfirmed
What it is

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00311 · 22.7th percentile
Weakness
CWE-404 · Improper Resource Shutdown or Release
Published
2026-10-06T19:17Z
Affected products (1)
ProductVersionsFixed in
vllm/vllm≤ 0.31.0—
References (7)
https://gist.github.com/Yunzez/5c70a3bb328eaf6d646b9d31e879dc4a#file-repro_prompt_embeds_penalties_engine_crash-py · [email protected]https://github.com/vllm-project/vllm/ · [email protected]https://github.com/vllm-project/vllm/issues/57719 · [email protected]https://vuldb.com/cve/CVE-2026-105922 · [email protected]https://vuldb.com/submit/992707 · [email protected]https://vuldb.com/vuln/413896 · [email protected]https://vuldb.com/vuln/413896/cti · [email protected]
EPSS history
Timeline
  • 08 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 06 OCT 14:45Z
    vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service
    cvelistv5