CVE-2026-90713: vLLM TiktokenTokenizer DOS Vulnerability

CVE-2026-90713 Overview

CVE-2026-90713 affects vllm-project vLLM through version 0.29.0. The flaw resides in the TiktokenTokenizer::new function within rust/src/text/src/backend/hf/mod.rs, part of the tiktoken vocab file handler component. Manipulation of the affected element results in a denial of service condition against the vLLM inference process. Exploitation requires local access with low privileges and no user interaction. A public exploit has been released, and a pull request addressing the issue is awaiting acceptance upstream. The weakness maps to [CWE-404], improper resource shutdown or release.

Critical Impact

A local, low-privileged actor can trigger a denial of service in vLLM by supplying a crafted tiktoken vocabulary file, disrupting availability of the model inference service.

Affected Products

• vllm-project vLLM up to and including version 0.29.0
• The Rust tiktoken vocab file handler in rust/src/text/src/backend/hf/mod.rs
• Deployments that load user-supplied or third-party tokenizer vocabulary files

Discovery Timeline

• 2026-09-14 - CVE-2026-90713 published to NVD
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90713

Vulnerability Analysis

The vulnerability sits in the constructor path of TiktokenTokenizer::new inside vLLM's Rust text backend. When the tiktoken vocab file handler processes a malformed or oversized vocabulary artifact, the routine fails to release resources cleanly. The result is a denial of service against the tokenizer initialization path, which in turn stalls or terminates the vLLM serving process.

Because vLLM is commonly deployed as a shared inference backend for large language models, disruption of the tokenizer prevents downstream request handling. The impact is limited to availability. There is no confirmed impact to confidentiality or integrity, and no code execution primitive has been reported. See the VLLM Issue #50954 and VulDB CVE-2026-90713 entries for reference material.

Root Cause

The root cause is improper resource shutdown or release ([CWE-404]) during tokenizer construction. The tiktoken vocab file handler does not correctly bound or clean up resources when parsing untrusted vocabulary input, allowing an attacker to force the process into an unrecoverable state.

Attack Vector

The attack vector is local. An actor with local access and low privileges on the host running vLLM must be able to influence which tiktoken vocabulary file the tokenizer loads. This includes staging a malicious vocab file in a path consumed by TiktokenTokenizer::new or supplying it through a tokenizer configuration parameter. No user interaction is required. A public proof-of-concept is referenced in the GitHub Gist Code Snippet.

Technical details of the exploit are described in prose only. Refer to the VLLM Pull Request #51135 for the proposed fix and reproduction context.

Detection Methods for CVE-2026-90713

Indicators of Compromise

• Unexpected termination or hang of vLLM worker processes shortly after tokenizer initialization.
• Appearance of unfamiliar or oversized tiktoken vocabulary files in model or tokenizer directories.
• Repeated failed tokenizer load attempts referencing TiktokenTokenizer::new in vLLM logs.

Detection Strategies

• Monitor vLLM service logs for tokenizer initialization errors or panics originating in rust/src/text/src/backend/hf/mod.rs.
• Alert on process crashes or restart loops for the vLLM inference service.
• Track filesystem writes to tokenizer and model asset directories by non-service accounts.

Monitoring Recommendations

• Baseline expected sizes and hashes of tiktoken vocabulary files and alert on drift.
• Instrument the vLLM host to capture resource exhaustion signals such as sudden memory or file-descriptor spikes during tokenizer loads.
• Correlate local shell activity with subsequent vLLM service failures to detect abuse by low-privileged users.

How to Mitigate CVE-2026-90713

Immediate Actions Required

• Restrict local access to hosts running vLLM to trusted administrators and service accounts only.
• Enforce strict filesystem permissions on tokenizer and model directories so only the vLLM service account can write.
• Validate the provenance and integrity of every tiktoken vocabulary file before loading it into vLLM.

Patch Information

An upstream fix is proposed in VLLM Pull Request #51135 and is awaiting acceptance at the time of publication. Track the VLLM Project Repository for the release that includes the merged fix and upgrade beyond vLLM 0.29.0 once available.

Workarounds

• Load only tokenizer vocabularies from trusted, signed sources and reject files from untrusted local paths.
• Run vLLM under a dedicated, unprivileged service account with a restricted working directory to limit which vocab files it can reach.
• Add a supervisor or process manager that rate-limits automatic restarts to prevent a crash loop from masking active abuse.

# Configuration example
# Restrict tokenizer directory to the vLLM service account only
chown -R vllm:vllm /opt/vllm/tokenizers
chmod -R 750 /opt/vllm/tokenizers

# Prevent non-service local users from writing new vocab files
find /opt/vllm/tokenizers -type d -exec chmod g-w,o-w {} \;