CVE-2026-105922

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.31.1

Description A flaw in the Penalty Handler component allows remote attackers to cause a denial of service. The issue resides in the get token bin counts and mask() function within the vllm/model executor/layers/utils.py file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the get token bin counts and mask() function to minimize the risk of exploitation.