CVE-2026-93592: vLLM input validation bypass in embeddings and pooling endpoints

CVE-2026-93592 · Severity: high · CVSS 7.5 · Published 2026-09-18

vLLM is a widely used inference engine that serves language model embedding and pooling tasks via REST API. Versions before 0.28.0 fail to validate that token IDs are non-negative, allowing an unauthenticated attacker to send a single malicious request that crashes the entire service and makes it unresponsive until manually restarted. This causes a complete denial of service for all users of the service.

Technologies: vllm (PyPI), Vllm. Vendors: PyPI, Vllm.

Quick answers

Is CVE-2026-93592 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-93592 being exploited in the wild.
How severe is CVE-2026-93592?
High severity, with a CVSS score of 7.5, published 18 September 2026.
Which products and versions are affected?
vllm (PyPI) ECOSYSTEM:introduced=0,fixed=0.28.0; Vllm < 0.28.0.
Is there a fix for CVE-2026-93592?
Yes. vllm (PyPI): upgrade to 0.28.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93592 attacked?
It is attacked over the network.
Am I affected by CVE-2026-93592?
Check whether you run vllm (PyPI) or Vllm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vllm (PyPI): upgrade to 0.28.0 or later
    pip install "vllm>=0.28.0"

Technical details

The vulnerability is an improper input validation (CWE-129) affecting the /v1/embeddings and /pooling endpoints. The InputProcessor._validate_model_input function checked only the upper bound of token IDs against the vocabulary size but failed to validate the lower bound, allowing negative token IDs to pass through to the GPU. When a negative ID is used as an array index in PyTorch's GPU indexing kernel, it triggers an unhandled CUDA device-side assertion that poisons the GPU context. This is not a catchable Python exception; after the assertion fires, all subsequent CUDA operations in the process fail, causing the entire service to become unresponsive. The attack requires no authentication and can be triggered by a single HTTP POST request with input such as [[-1, 1879]]. The fix (released in 0.28.0) adds a lower-bound check to reject negative IDs with HTTP 400 before they reach the GPU.

Affected products

  • vLLM vLLM < 0.28.0

Identifiers

  • CVE-2026-93592
  • PYSEC-2026-3997

Timeline

  • 2026-09-18: disclosed
  • 2026-09-03: patched: Fix released in version 0.28.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.