CVE-2026-90713CWE-404

CVE-2026-90713

Low · published September 14, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
4.8
In the wild
Unconfirmed
What it is

A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/src/backend/hf/mod.rs of the component tiktoken vocab File Handler. The manipulation results in denial of service. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
4.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00160 · 4.8th percentile
Weakness
CWE-404 · Improper Resource Shutdown or Release
Published
2026-09-14T17:19Z
References (8)
https://gist.github.com/Yunzez/4b08ec3568a8cbfb120062e2558382b8 · [email protected]https://github.com/vllm-project/vllm/ · [email protected]https://github.com/vllm-project/vllm/issues/50954 · [email protected]https://github.com/vllm-project/vllm/pull/51135 · [email protected]https://vuldb.com/cve/CVE-2026-90713 · [email protected]https://vuldb.com/submit/918762 · [email protected]https://vuldb.com/vuln/403267 · [email protected]https://vuldb.com/vuln/403267/cti · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 12:00Z
    vllm-project vLLM tiktoken vocab File mod.rs new denial of service
    cvelistv5