Expected behavior violation in vLLM - CVE-2026-114049

Vulnerability details

The vulnerability allows a remote attacker to constrain another client's generated output to an attacker-chosen token allowlist.

The vulnerability exists due to failure to clear a vacated token-allowlist mask row in vLLM V1 InputBatch.condense() when compacting active batch requests. A remote attacker can submit a request with chosen allowed_token_ids and trigger concurrent batch-slot reuse while that constrained request remains active to make an unrestricted request inherit the stale allowlist.

Affected software

How to mitigate CVE-2026-114049

External References

• https://github.com/vllm-project/vllm/security/advisories/GHSA-6cxc-2vcg-w5qc

Related Security Bulletins

• Multiple vulnerabilities in vLLM