All vulnerabilities
CVE-2026-114049GHSA-6cxc-2vcg-w5qc

vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense

vllm-project vllm
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.31.0Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycled batch slots apply their token allowlist to victims' unrestricted requests.

Text from CVE List

Affected versions 2

  • vllmaffected: all versions before 0.31.0CVE List
  • vllmunaffected: 0.31.0CVE List

References 2