A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
References
| Link | Resource |
|---|---|
| https://gist.github.com/Yunzez/5c70a3bb328eaf6d646b9d31e879dc4a#file-repro_prompt_embeds_penalties_engine_crash-py | Third Party Advisory |
| https://github.com/vllm-project/vllm/ | Product |
| https://github.com/vllm-project/vllm/issues/57719 | Issue Tracking |
| https://vuldb.com/cve/CVE-2026-105922 | Third Party Advisory |
| https://vuldb.com/submit/992707 | Third Party Advisory |
| https://vuldb.com/vuln/413896 | Third Party Advisory |
| https://vuldb.com/vuln/413896/cti | Permissions Required |
Configurations
History
09 Oct 2026, 14:13
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:* | |
| First Time |
Vllm vllm
Vllm |
|
| References | () https://gist.github.com/Yunzez/5c70a3bb328eaf6d646b9d31e879dc4a#file-repro_prompt_embeds_penalties_engine_crash-py - Third Party Advisory | |
| References | () https://github.com/vllm-project/vllm/ - Product | |
| References | () https://github.com/vllm-project/vllm/issues/57719 - Issue Tracking | |
| References | () https://vuldb.com/cve/CVE-2026-105922 - Third Party Advisory | |
| References | () https://vuldb.com/submit/992707 - Third Party Advisory | |
| References | () https://vuldb.com/vuln/413896 - Third Party Advisory | |
| References | () https://vuldb.com/vuln/413896/cti - Permissions Required |
06 Oct 2026, 15:19
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-06 15:17
Updated : 2026-10-09 14:13
NVD link : CVE-2026-105922
Mitre link : CVE-2026-105922
CVE.ORG link : CVE-2026-105922
JSON object : View
Products Affected
vllm
- vllm
CWE
CWE-404
Improper Resource Shutdown or Release