rootpwn

high · CVSS v3 5.9 · CVSS v4 8.2

CVE-2026-100652

vLLM versions 0.22.0 through 0.23.0 have a validation flaw that allows out-of-vocabulary stop_token_ids to be processed, causing CUDA tensor

Overview

vLLM versions 0.22.0 through 0.23.0 have a validation flaw that allows out-of-vocabulary stop_token_ids to be processed, causing CUDA tensor indexing failures. This can crash the EngineCore, requiring a service restart. The issue affects deployments using the Rust HTTP or gRPC frontends.

Description

vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids to trigger CUDA tensor indexing failures that leave EngineCore in a fatal state requiring service restart.

Impact

Confidentiality: no direct data exposure. Integrity: potential denial of service by crashing EngineCore. Availability: service interruption until restart. Impacted parties: organizations running vLLM inference services, especially those using Rust frontends.

Remediation

Upgrade to vLLM 0.23.1 or later where stop_token_ids bounds are validated. If upgrade not possible, disable or sanitize stop_token_ids in requests, enforce min_tokens=0, or implement request validation to reject out-of-range IDs. Monitor logs for CUDA tensor errors and restart services automatically.

Risk context

High severity with CVSS v4 score of 8.2 indicates a significant risk. No EPSS data available, but the flaw can cause service crashes, so timely patching is recommended.

Affected products

  • vLLM 0.22.0
  • vLLM 0.23.0
  • Rust HTTP frontend
  • Rust gRPC frontend

Scores

Severity
high
CVSS v2
5.4
CVSS v3
5.9
CVSS v4
8.2
EPSS
—

vLLM Rust CUDA Denial-of-Service TensorIndexing Frontends Patch ServiceCrash

← All CVEs

Related CVEs

high

CVE-2026-100644

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks.

View analysis

high

CVE-2026-100676

January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG (e.g. via the /proxy endpoint) can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding. Because each referenced file is read in full with no effective limit on the number or total volume of reads, a single request can also generate an unbounded amount of local filesystem I/O and memory pressure (the published proof of concept drives about 4.34 GB of reads), leading to denial of service. The issue is fixed in 0.15.5.

View analysis

high

CVE-2026-100690

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them.

View analysis

high

CVE-2026-100692

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -> /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts.

View analysis