GPU VulnDB

Database/AI/ML frameworks & serving

vLLM: negative token IDs in embeddings requests poison the CUDA context and wedge the engine

CVSS 8.7CVE-2026-93592AI/ML frameworks & servingcurated

Impact

A single unauthenticated request carrying a negative token ID to /v1/embeddings or /pooling trips a CUDA device-side assertion. Once that assertion fires the GPU context is poisoned, so every subsequent request on that engine fails until the process is restarted - one malformed request takes the whole model replica out of service, not just its own request. On a GPU fleet this converts a trivially cheap request into a persistent denial of service against an expensive accelerator, and it can be repeated immediately after each restart. Where the inference endpoint is reachable by tenants or by an internal gateway without auth, any caller can keep a GPU idle indefinitely.

Who can reach it

Anyone who can send HTTP requests to the vLLM API server. No authentication is required - vLLM's OpenAI-compatible server does not authenticate by default, so exposure equals whatever network reach the endpoint has (tenant pods, an internal gateway, or the public internet if fronted directly).

What to do

Upgrade vLLM to 0.28.0 or later and restart each serving process; no node reboot or driver change is needed, but every model replica has to be cycled, so drain traffic per replica to avoid a serving gap. Until then, put authentication and an input-validation proxy in front of the embeddings and pooling endpoints, or disable those endpoints if unused, and make sure the supervisor restarts a wedged engine automatically.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-93592https://github.com/vllm-project/vllm/security/advisories/GHSA-25q3-v2hm-8vpfhttps://www.vulncheck.com/advisories/vllm-before-0.28.0-denial-of-service-via-negative-token-id

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.