CVE-2026-114049

Analyzed Analyzed - Analysis Complete

Cross-Request Mask Leak in vLLM

Publication date: 2026-10-21

Last updated on: 2026-11-03

Assigner: VulnCheck

Description

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycled batch slots apply their token allowlist to victims' unrestricted requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-11-03

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114049

EUVD

EUVD-2026-107000

Affected Vendors & Products

Vendor	Product	Version / Range
vllm	vllm	to 0.31.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-440	A feature, API, or function does not perform according to its specification.

Attack-Flow Graph

Executive Summary

vLLM before 0.31.0 has a flaw in InputBatch.condense() where a stale allowed_token_ids mask can leak across requests. Attackers submit concurrent constrained generation requests, including unauthenticated ones via /invocations. When batch slots are recycled, the attacker's token allowlist is incorrectly applied to other users' unrestricted requests, constraining their outputs without their knowledge.

Detection Guidance

To detect this vulnerability, monitor for concurrent constrained generation requests targeting the /invocations endpoint in vLLM versions before 0.31.0. Check logs for requests with token allowlists being applied unexpectedly to other users' outputs. No specific commands are provided in the resources, but inspecting server logs for batch slot recycling issues may reveal anomalies.

Impact Analysis

This vulnerability could allow an attacker to limit the outputs of your requests by applying their token restrictions to your unrestricted requests. This means your generated content might be artificially constrained without your consent, potentially affecting the quality or relevance of the output you receive.

Compliance Impact

This vulnerability primarily impacts data integrity by allowing unauthorized token restrictions to affect other users' outputs. While it does not directly expose confidential data, it could lead to unauthorized modifications of generated content, which may violate integrity requirements in GDPR (Article 5) and HIPAA (Security Rule). Compliance risks arise if the system processes regulated data where output integrity is critical.

Mitigation Strategies

Upgrade vLLM to version 0.31.0 or later to address the InputBatch.condense() flaw. If immediate upgrade is not possible, restrict access to the /invocations endpoint and avoid concurrent constrained generation requests. Monitor for unusual token restrictions applied across requests.

Hi! I’m here to help you understand CVE-2026-114049. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...