Vulnerability PYSEC-2026-4000
Medium Risk
MEDIUM RISK
CVSS Score: 4.3
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
9 days ago
September 19, 2026 at 11:17 PM UTC
No summary available
0.0.1 - 0.29.0
0.0.1 - 0.29.0
Details
vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests to return incorrect tokens.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
10 days ago
No summary available
0.0.1 - 0.28.0 PYSEC-2026-3998
0.0.1 - 0.28.0 PYSEC-2026-3998
Medium Risk
10 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-3999
0.0.1 - 0.29.0 PYSEC-2026-3999
Unknown
10 days ago
No summary available
0.0.1 - 0.27.1 PYSEC-2026-3997
0.0.1 - 0.27.1 PYSEC-2026-3997
Unknown
11 days ago
No summary available
0.0.1 - 0.29.0 PYSEC-2026-3996
0.0.1 - 0.29.0 PYSEC-2026-3996
Medium Risk
11 days ago
vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation
0.0.1 - 0.27.1 GHSA-8pw2-6jv3-mj5j
0.0.1 - 0.27.1 GHSA-8pw2-6jv3-mj5j
Impacted packages
Timeline
Published
9 days ago
September 19, 2026 at 11:17 PM UTC
Fixed (0.30.0)
7 days ago
September 22, 2026 at 05:23 AM UTC
Last Modified
2 hours ago
September 29, 2026 at 09:00 AM UTC