CVE-2026-105922

Undergoing Analysis Undergoing Analysis - In Progress

Denial of Service in vLLM up to 0.31.0

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: VulDB

Description

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105922

EUVD

EUVD-2026-93430

Affected Vendors & Products

Vendor	Product	Version / Range
vllm	vllm	to 0.31.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-404	The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service flaw in vLLM versions up to 0.31.0. It exists in the Penalty Handler component, specifically in the get_token_bin_counts_and_mask function of vllm/model_executor/layers/utils.py. Attackers can exploit this by manipulating inputs to cause system disruption.

Detection Guidance

The CVE does not provide specific detection methods or commands. However, you can monitor for unusual activity in the vLLM Penalty Handler component, particularly in the get_token_bin_counts_and_mask function. Check for crashes or high CPU usage in vLLM processes. Ensure your vLLM version is updated beyond 0.31.0 if available.

Impact Analysis

If you use vLLM up to 0.31.0, an attacker could remotely trigger this flaw to make your system unresponsive or crash. Since exploit code is public, the risk of attack is higher. The impact is limited to availability disruption.

Compliance Impact

The vulnerability causes denial of service through remote exploitation, which may lead to unauthorized access or disruption of services. This could impact compliance with GDPR by potentially exposing personal data during an attack or failing to ensure availability of services. For HIPAA, it may affect the integrity and availability of protected health information if systems are disrupted.

Mitigation Strategies

Immediately upgrade vLLM to a version beyond 0.31.0 to address the flaw in the Penalty Handler component. If upgrading is not possible, disable the affected function or restrict network access to the vulnerable system until a patch is applied.

Hi! I’m here to help you understand CVE-2026-105922. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70