CVE-2026-105922: vLLM 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 0.10, 0.11, 0.12, 0.13, 0.14, 0.15, 0.16, 0.17, 0.18, 0.19, 0.20…

Affected technology

vLLM · 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 0.10, 0.11, 0.12, 0.13, 0.14, 0.15, 0.16, 0.17, 0.18, 0.19, 0.20, 0.21, 0.22, 0.23, 0.24, 0.25, 0.26, 0.27, 0.28, 0.29, 0.30, 0.31.0
vllm-project

Description’s affected range: up to 0.31.0

Component: Penalty Handler
Function: get_token_bin_counts_and_mask
File: vllm/model_executor/layers/utils.py

Attack conditions (VulDB, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could disrupt service. VulDB’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality and integrity impact as none; availability impact as low.