CVE-2026-105922: vLLM Project Denial of Service Vulnerability

CVE-2026-105922 Overview

CVE-2026-105922 is a denial of service vulnerability affecting vllm-project vLLM through version 0.31.0. The flaw resides in the get_token_bin_counts_and_mask function within vllm/model_executor/layers/utils.py, part of the Penalty Handler component. A remote attacker with low-level privileges can submit crafted input that triggers the condition and crashes the inference engine. A public proof-of-concept exploit has been released, increasing the risk of opportunistic abuse against exposed vLLM deployments. The project maintainers were notified through an issue report but have not responded at the time of publication, leaving affected deployments without an official patch.

Critical Impact
Remote attackers with API access can crash vLLM inference engines, disrupting model serving availability for all consumers of the affected endpoint.

Affected Products

vllm-project vLLM versions up to and including 0.31.0
Deployments exposing the Penalty Handler path via prompt embeddings
Self-hosted LLM inference services built on vulnerable vLLM releases

Discovery Timeline

2026-10-06 - CVE CVE-2026-105922 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105922

Vulnerability Analysis

The vulnerability sits in the Penalty Handler pipeline that applies repetition, presence, and frequency penalties during token sampling. The get_token_bin_counts_and_mask function in vllm/model_executor/layers/utils.py fails to properly handle specific input conditions when prompt embeddings are supplied alongside penalty parameters. The resulting unhandled exception propagates through the inference engine and terminates the serving process. Because vLLM typically runs as a long-lived process serving multiple tenants, a single crafted request can disrupt service for all connected clients. The weakness is categorized under CWE-404: Improper Resource Shutdown or Release.

Root Cause

The root cause is improper input handling in the penalty computation path. When prompt embeddings are combined with penalty-related sampling parameters, the function enters an unexpected state and raises an uncaught error. The engine lacks defensive validation and recovery logic to isolate the failure to the individual request.

Attack Vector

Exploitation requires network access to the vLLM API and authenticated low-privilege access sufficient to submit an inference request. The attacker sends a request that combines prompt_embeds with sampling parameters that trigger the penalty code path. The engine processes the request, hits the faulty branch, and crashes. A public proof-of-concept script is available in a GitHub Gist demonstrating the engine crash reproduction. Additional context is tracked in VLLM Project Issue #57719.

See the published proof-of-concept at the GitHub Gist referenced above for
technical reproduction details. No synthetic exploit code is provided here.

Detection Methods for CVE-2026-105922

Indicators of Compromise

Unexpected termination or restart of vLLM inference engine processes without resource exhaustion signals
Python tracebacks in vLLM logs referencing get_token_bin_counts_and_mask or vllm/model_executor/layers/utils.py
API requests combining prompt_embeds payloads with non-zero presence_penalty, frequency_penalty, or repetition_penalty values from untrusted callers

Detection Strategies

Monitor vLLM process lifecycle events and correlate crashes with recent inbound API requests
Inspect application logs for stack traces originating in the Penalty Handler module
Deploy request logging at the API gateway to retain prompt embedding payload metadata for forensic review

Monitoring Recommendations

Alert on repeated inference engine restarts within short time windows
Track HTTP 5xx response rates and sudden drops in successful completion throughput
Baseline the distribution of sampling parameters per client and flag anomalous combinations

How to Mitigate CVE-2026-105922

Immediate Actions Required

Restrict network exposure of vLLM endpoints to trusted clients using network segmentation or allowlists
Enforce authentication and per-client rate limiting at the API gateway in front of vLLM
Reject or sanitize inference requests that combine prompt_embeds with penalty sampling parameters until a fix is available

Patch Information

No vendor patch is available at the time of publication. According to the advisory, the vLLM project was informed through an issue report but has not responded. Monitor the VLLM Project Repository and VLLM Project Issue #57719 for updates. Additional vulnerability metadata is published at VulDB CVE-2026-105922.

Workarounds

Run vLLM behind a supervisor process that restarts the engine automatically to limit downtime from crash attempts
Deploy a request-filtering proxy that strips or validates prompt_embeds fields from untrusted sources
Disable penalty-related sampling parameters for client tiers that do not require them

bash

# Example gateway filter: reject requests combining prompt_embeds with penalties
# Pseudocode for an API gateway rule
if request.body.contains("prompt_embeds") and (
     request.body.presence_penalty != 0 or
     request.body.frequency_penalty != 0 or
     request.body.repetition_penalty != 1):
    return 400, "Unsupported parameter combination"