Description
vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow concurrent requests to sample tokens outside their allowlists.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vllm-project | vllm | < 0.29.0 | 0.29.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | vllm | < 0.29.0 | 0.29.0 | PYSEC-2026-3998 |
Advisories 1
- WID-SEC-2026-3483 vllm: Mehrere Schwachstellen ermöglichen Manipulation von Daten BSI CERT-Bund (WID) · Sep 27, 2026
References
- https://github.com/vllm-project/vllm/pull/49080 patch issue-tracking
- https://github.com/vllm-project/vllm product
- https://github.com/vllm-project/vllm/commit/5b0e5b69ac1a3884a6479c9537789c95263cc804 patch
- https://github.com/vllm-project/vllm/blob/v0.28.0/vllm/sampling_params.py#L881-L903 technical-description
- https://github.com/vllm-project/vllm/blob/v0.28.0/vllm/v1/worker/gpu/sample/logit_bias.py#L179-L191 technical-description
- VulnCheck Advisory: vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids third-party-advisory