Database/AI/ML frameworks & serving
vLLM: malformed tiktoken vocab file crashes the tokenizer backend, denying service on the GPU node
Impact
A local user who can place or point vLLM at a crafted tiktoken vocabulary file triggers a failure in TiktokenTokenizer::new in the Rust text backend, taking the server down. On a GPU node that means the inference process dies and the GPUs it held go idle until the serving pod restarts; no data disclosure or integrity loss is claimed by the record. Severity is rated very low (CVSS 1.9) because it needs local access and an already-privileged path to supply the vocab file. The record notes a public proof of concept exists and the fix is still an unmerged pull request.
Who can reach it
Local user on the serving host with an existing low-privilege account who can influence the tokenizer vocab file vLLM loads. No remote or network path is described.
What to do
No released fix at the time of the record - the upstream pull request is still awaiting acceptance. Until it lands, restrict who can write model and tokenizer directories mounted into vLLM pods and load vocab files only from trusted artifact storage. Applying the fix when released is a container image update and a restart of the vLLM process, not a node reboot.
References
Related entries
- llama.cpp: a crafted GGUF file trips a reachable assertion and aborts the process loading itCVE-2026-52131 · llama.cpp (gguf_reader::read GGUF model file parser)Unscored
- llama.cpp server: negative top_n on /rerank drives an unbounded allocation and denial of serviceCVE-2026-52132 · llama.cpp server /rerank endpoint (top_n handling under --reranking)Unscored
- Hugging Face Transformers: load_custom_generate writes remote code to disk before the trust checkCVE-2026-80047 · Hugging Face Transformers (dynamic_module_utils.py, load_custom_generate remote-code cache)Unscored
- SGLang: unauthenticated pickle deserialization on /update_weights_from_tensor gives code executionCVE-2026-86793 · SGLang inference server (/update_weights_from_tensor, SafeUnpickler)Unscored
- Jupyter Notebook (untrusted notebooks): Untrusted notebook executes JavaScript in the user's session on openCVE-2021-32798 · Jupyter Notebook (untrusted notebooks)Critical
- MLflow: Absolute path traversal prior to 2.5.0CVE-2023-3765 · MLflowCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.