vLLM: unvalidated bad_words token indices corrupt logits of other in-flight requests

Impact

vLLM through 0.29.0 does not check that bad_words token indices fall inside the model's generation output width before they reach the GPU sampling kernel, so an out-of-bounds index writes into logits memory belonging to other requests batched alongside it. On a shared inference endpoint that means one caller can make a different caller's completion return wrong tokens - a cross-request integrity failure inside a single continuous-batching engine, not just a crash of the caller's own request. For an operator this is the kind of bug that surfaces as unreproducible bad output on a busy node and is very hard to attribute. Impact is limited to output integrity; the record claims no disclosure of the other request's content and no code execution.

Who can reach it

Any client authenticated to the vLLM OpenAI-compatible API that is allowed to set sampling parameters, in any deployment where requests from different callers share one engine. No privileged access to the node is needed; the attacker only needs to submit a request with a crafted bad_words value.

What to do

Upgrade vLLM past the fix in vllm-project/vllm PR 48824 and restart each serving process - a rolling restart of the model replicas, no node reboot. Until then, the practical mitigation is to reject or strip bad_words at the gateway in front of vLLM, or to stop batching requests from different tenants on one engine.

References

Related entries

• Langflow: authenticated user reaches eval() through component input options and runs code on the hostCVE-2026-101861 · Langflow schema.py (eval() on component input option values)Low
• vLLM: out-of-bounds read in Mamba2 mixer reachable from a completions requestCVE-2026-105775 · vLLM (Mamba2 mixer conv_ssm_forward, completions request handler)Low
• vLLM: engine crash via the penalty handler when prompt embeds are combined with penaltiesCVE-2026-105922 · vLLM (penalty handler, get_token_bin_counts_and_mask in model_executor/layers/utils.py)Low
• sherpa-onnx: unvalidated vocab_size in model metadata overflows a buffer in the transducer greedy decoderCVE-2026-108954 · sherpa-onnx OfflineTransducerGreedySearchDecoder (model-supplied vocab_size)Low
• finetrainers: code injection through the library field of a model indexCVE-2026-124588 · Hugging Face finetrainers (model index loader, resolve_component_cls)Low
• mistral.rs: out-of-bounds read parsing GGUF token id metadata crashes the inference serverCVE-2026-75090 · mistral.rs GGUF tokenizer (convert_gguf_to_hf_tokenizer)Low