{"action":"Upgrade vllm to 0.32.0 or later.","affected":[{"fixed":"0.32.0","introduced":"0"}],"component":"vllm","cve_ids":["CVE-2026-105922"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.32.0"],"id":"tcs_01M5JHJJNE25HRQTSR5PW9FGKX","modified_at":"2026-10-18T13:45:02.439769873Z","published_at":"2026-10-06T15:17:17.727Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4319","https://github.com/vllm-project/vllm/","https://gist.github.com/Yunzez/5c70a3bb328eaf6d646b9d31e879dc4a#file-repro_prompt_embeds_penalties_engine_crash-py","https://vuldb.com/cve/CVE-2026-105922","https://vuldb.com/submit/992707","https://vuldb.com/vuln/413896","https://github.com/vllm-project/vllm/issues/57719","https://vuldb.com/vuln/413896/cti"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-4319","url":"https://osv.dev/vulnerability/PYSEC-2026-4319"},{"source":"nvd","source_id":"CVE-2026-105922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105922"}],"summary":"A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty"}