CVE-2026-105922
1 advisory.
PyPI/vllm CVE-2026-105922: medium 4.3
A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty
Action: Upgrade vllm to 0.32.0 or later.
pip install vllm==0.32.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.32.0 | - |
Fixed versions
| 0.32.0 |
Sources
- osv: PYSEC-2026-4319
- nvd: CVE-2026-105922
- https://github.com/vllm-project/vllm/
- https://gist.github.com/Yunzez/5c70a3bb328eaf6d646b9d31e879dc4a#file-repro_prompt_embeds_penalties_engine_crash-py
- https://vuldb.com/cve/CVE-2026-105922
- https://vuldb.com/submit/992707
- https://vuldb.com/vuln/413896
- https://github.com/vllm-project/vllm/issues/57719
- https://vuldb.com/vuln/413896/cti
CVE-2026-105922 · published · modified · JSON