UpHeron
All vulnerabilities

Servers and applications

CVE-2026-105922

vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service

Severity
Low 2.1
Published
6 Oct 2026
Last changed
9 Oct 2026
Added to UpHeron
3 Nov 2026
Sources
NVD, CVE Program

Description

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project…

Affected software

SoftwareAffected versions
vLLMServers and applications · cna:vllm-project|vllm
  • Version 0.31.0
  • Version 0.30
  • Version 0.29
  • Version 0.28
All 31 release lines
  • Version 0.1
  • Version 0.2
  • Version 0.3
  • Version 0.4
  • Version 0.5
  • Version 0.6
  • Version 0.7
  • Version 0.8
  • Version 0.9
  • Version 0.10
  • Version 0.11
  • Version 0.12
  • Version 0.13
  • Version 0.14
  • Version 0.15
  • Version 0.16
  • Version 0.17
  • Version 0.18
  • Version 0.19
  • Version 0.20
  • Version 0.21
  • Version 0.22
  • Version 0.23
  • Version 0.24
  • Version 0.25
  • Version 0.26
  • Version 0.27
  • Version 0.28
  • Version 0.29
  • Version 0.30
  • Version 0.31.0
vLLMServers and applications · cpe:a:vllm:vllm
  • Every version up to 0.31.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-105922
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-105922