Description
vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycled batch slots apply their token allowlist to victims' unrestricted requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vllm-project | vllm | < 0.31.0 | 0.31.0 |
Advisories 1
- WID-SEC-2026-4076 vllm: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
References
- GitHub Security Advisory (GHSA-6cxc-2vcg-w5qc) vendor-advisory
- VulnCheck Advisory: vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense third-party-advisory