vLLM: VLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings…
vLLM
More for vLLM RSS feed for vLLM
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Record
- CVE-2026-93592
- Affects
- vLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 18, 2026
- Source last modified
- September 28, 2026
Description
vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that poisons the GPU context, causing all subsequent requests to fail until the process restarts.
Description quoted from the NVD record.
Who is affected
This flaw affects vLLM, software that runs AI language models so that other apps and staff can use them. It affects all versions before 0.28.0, in the parts of the product that turn text into embeddings (number summaries of text) and the related pooling feature. Someone who does not need to log in can send a single request containing an invalid value that crashes the engine. The graphics processor then stays stuck, so every later request fails until the program is restarted. This flaw is rated High.
What to do
- Find out who runs vLLM for your organization: the person who installed it, or the IT provider or vendor that manages it for you.
- If you run it yourselves, update vLLM to version
0.28.0or later, which fixes this flaw. - If an IT provider or vendor runs it for you, send them this advisory and ask when the update to
0.28.0will be done. - Until the update is done, if vLLM suddenly stops answering requests, restarting the program brings it back, though the same problem can happen again.
Analysis written from the source record as of September 28, 2026 and reviewed before publishing.