Vulnerability PYSEC-2026-4319
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
12 days ago
October 06, 2026 at 03:17 PM UTC
No summary available
0.0.1 - 0.31.0
0.0.1 - 0.31.0
Details
A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
3 days ago
vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle
0.0.1 - 0.29.0 PYSEC-2026-4308
0.0.1 - 0.29.0 PYSEC-2026-4308
Medium Risk
3 days ago
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
0.0.1 - 0.29.0 PYSEC-2026-4306
0.0.1 - 0.29.0 PYSEC-2026-4306
Medium Risk
3 days ago
vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion
0.23.0 - 0.29.0 PYSEC-2026-4307
0.23.0 - 0.29.0 PYSEC-2026-4307
Medium Risk
3 days ago
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
0.0.1 - 0.29.0 PYSEC-2026-4309
0.0.1 - 0.29.0 PYSEC-2026-4309
Medium Risk
3 days ago
vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach
0.24.0 - 0.29.0 PYSEC-2026-4310
0.24.0 - 0.29.0 PYSEC-2026-4310
Impacted packages
Timeline
Published
12 days ago
October 06, 2026 at 03:17 PM UTC
Fixed (0.32.0)
6 hours ago
October 18, 2026 at 10:04 AM UTC
Last Modified
2 hours ago
October 18, 2026 at 01:45 PM UTC