Read the docs
TI-2026-68456 Aliases CVE-2026-105922GHSA-x9pq-jx6q-p3qv

Resource release flaw in vLLM penalty handler causes denial of service

Priority MEDIUM 57CWE-404Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-404.

Summary

vLLM up to 0.31.0 is affected. In the get_token_bin_counts_and_mask function of the penalty handler, improper resource release (CWE-404) lets a manipulation cause a denial of service. A remote attacker with low privileges can trigger it without user interaction. The exploit has been publicly released.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00311 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vllm-projectvLLM0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11; 0.12; 0.13; 0.14; 0.15; 0.16; 0.17; 0.18; 0.19; 0.20; 0.21; 0.22; 0.23; 0.24; 0.25; 0.26; 0.27; 0.28; 0.29; 0.30; 0.31.0—No fix listedCNA
  • vLLM Vendorvllm-project Affected 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11; 0.12; 0.13; 0.14; 0.15; 0.16; 0.17; 0.18; 0.19; 0.20; 0.21; 0.22; 0.23; 0.24; 0.25; 0.26; 0.27; 0.28; 0.29; 0.30; 0.31.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*up to 0.31.0VulnerablevLLM
  • cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:* Versions up to 0.31.0 Vulnerable ·vLLM

Remediation

The sources list no fixed version for vLLM. Red Hat fixes Red Hat OpenShift AI 3.4 in RHSA-2026:92510, released 2026-10-29. Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3 and Red Hat OpenShift AI (RHOAI) are affected without a fix, and Red Hat lists no plan available for them.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Red Hat 1 advisory

  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift AI 3.4Fixed RHSA-2026:92510
Not affected: 3 products
  • Red Hat AI Inference Server
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.4

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105922
  2. 2026-10-06 Alias added: GHSA-x9pq-jx6q-p3qv
  3. 2026-10-06 CISA SSVC decision points changed
  4. 2026-10-06 Priority changed: LOW → MEDIUM
  5. 2026-10-07 Affected versions changed · Red Hat
  6. 2026-10-07 CVSS score added · Red Hat
  7. 2026-10-10 Affected versions changed · Red Hat
  8. 2026-10-21 Affected versions changed · Red Hat
  9. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  10. 2026-10-30 Fix available: Red Hat OpenShift AI 3.4 · Red Hat

References

Exploit 1

Other 2

  • TI-2024-10229 Remote Code Execution in vllm-project/vllm CVSS 3.0CRITICAL 9.8
  • TI-2024-08404 Remote Code Execution in vllm-project/vllm CVSS 3.1CRITICAL 9.8
  • TI-2026-36017 vLLM: OpenAI auth bypass CVSS 3.1CRITICAL 9.1
  • TI-2026-63056 vLLM before 0.28.0 Denial of Service via negative token ID CVSS 4.0HIGH 8.7
  • TI-2026-04308 Hardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security Control CVSS 3.0HIGH 8.8
  • TI-2026-39137 vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection CVSS 3.1HIGH 7.5
See all 124 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences