CVE-2026-93592 – Denial of Service (GPU Context Corruption) – vLLM before 0.28.0

Summary

CVE-2026-93592 is a Denial of Service (DoS) vulnerability in vLLM, the widely used open-source library for serving large language models. Versions prior to 0.28.0 fail to validate the lower bound of token IDs submitted to the /v1/embeddings and /pooling endpoints, allowing an unauthenticated remote attacker to send a single crafted request containing a negative token ID and crash the entire inference engine. The flaw carries a CVSS v4.0 base score of 8.7 (High), reflecting network exploitability with no authentication or user interaction required.

Technical details

• Root cause: vLLM’s token validation logic checks only the upper bound of token IDs against the model’s vocabulary size, but never checks that IDs are non-negative (CWE-129: Improper Validation of Array Index).
• Trigger conditions: An attacker submits a request to /v1/embeddings or /pooling with a negative integer as a token ID. Because negative values pass validation, they are used directly as an index into the embedding table on the GPU.
• Attack vector: Network-based, unauthenticated, single HTTP request — no special privileges or user interaction needed (AV:N/AC:L/PR:N/UI:N).
• Impact: The out-of-range index triggers a CUDA device-side assertion that poisons the GPU context. This corruption is unrecoverable at the process level — all subsequent inference requests fail until the vLLM process is restarted, resulting in a full denial of service for every client sharing that engine instance. Confidentiality and integrity are not affected; the impact is availability-only.

Affected software

• vllm-project vllm (PyPI package): all versions prior to 0.28.0
• Fixed in vLLM 0.28.0 (patch adds explicit lower-bound token ID validation, rejecting negative IDs with an HTTP 400 error before they reach the GPU)

Severity

• CVSS v4.0: 8.7 (High) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
• CVSS v3.1: 7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Mitigation and recommended actions

• Immediate: Upgrade to vLLM 0.28.0 or later, which validates that token IDs are non-negative before they are used to index the embedding table.
• If immediate patching is not possible:
  • Deploy a reverse proxy or API gateway in front of vLLM that filters/rejects negative integers in token-ID fields of requests to /v1/embeddings and /pooling.
  • Where possible, restrict these endpoints to accept only string input rather than raw token-ID arrays from untrusted clients.
  • Restrict network access to vLLM’s embeddings/pooling endpoints to trusted internal callers only.
  • Note: process-supervision/auto-restart alone is not an adequate mitigation, since the malicious request can be repeated immediately to re-trigger the crash.

References

• GitHub Security Advisory GHSA-25q3-v2hm-8vpf (vllm-project/vllm)
• CVE-2026-93592 record (CVE Program)
• VulnCheck Advisory: vLLM before 0.28.0 Denial of Service via negative token ID