CVE-2026-93592
1 advisory.
PyPI/vllm CVE-2026-93592: unknown, EPSS 0.54%
vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative to
Action: Upgrade vllm to 0.28.0 or later.
pip install vllm==0.28.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.28.0 | - |
Fixed versions
| 0.28.0 |
Sources
- osv: PYSEC-2026-3997
- https://www.vulncheck.com/advisories/vllm-before-0.28.0-denial-of-service-via-negative-token-id
- https://github.com/vllm-project/vllm/security/advisories/GHSA-25q3-v2hm-8vpf
CVE-2026-93592 · published · modified · JSON