CVE-2026-105922: vLLM: penalty handler flaw allows remote DoS

MEDIUM

Published October 6, 2026

CISO Take

A flaw in vLLM (up to 0.31.0) lets an authenticated low-privilege user crash the inference engine by sending a crafted request that exercises the penalty handler (get_token_bin_counts_and_mask, CWE-404 improper resource shutdown or release). The CVSS is a moderate 4.3, but a public reproduction script exists in a gist, and EPSS sits at 0.30% (79th percentile). It is not in CISA KEV and there is no SSVC decision. The maintainers have not yet responded to the issue (#57719), so no official fixed version is available. Treat it as an availability risk for shared inference endpoints. Until a fix ships, limit who can reach the API, validate or reject the penalty and prompt-embeds parameters at the gateway, and monitor for unexpected engine restarts.

Sources:NVDEPSSATLASGitHub Issues (vllm-project/vllm)VulDB

What is the risk?

Medium risk. Exploitation is network-reachable, low complexity, needs only low privileges and no user interaction. Impact is limited to availability (A:L); there is no confidentiality or integrity impact. The reproducer is public, which lowers the skill needed, but EPSS is low and there are no signs of active exploitation. The risk rises for multi-tenant or internet-exposed vLLM deployments where one engine crash disrupts every tenant. No patch is confirmed, so the exposure window is open.

How does the attack unfold?

Initial Access

Attacker obtains a low-privilege account or API key for a network-reachable vLLM endpoint.

AML.T0040

Exploitation

Attacker sends a crafted request with prompt embeds and sampling penalties that triggers the failure in get_token_bin_counts_and_mask.

AML.T0049

Impact

The inference engine crashes or hangs, denying service to all users and dependent AI applications.

AML.T0029

Initial Access

Attacker obtains a low-privilege account or API key for a network-reachable vLLM endpoint.

AML.T0040

Exploitation

Attacker sends a crafted request with prompt embeds and sampling penalties that triggers the failure in get_token_bin_counts_and_mask.

AML.T0049

Impact

The inference engine crashes or hangs, denying service to all users and dependent AI applications.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
95.4K94 dependentsPushed 6d ago27% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

ALow

What should I do?

1 step

1) Check for upstream fix or advisory in vllm-project/vllm issue #57719 and upgrade to the first release above 0.31.0 that addresses it. 2) Until then, put an API gateway or reverse proxy in front of vLLM that enforces authentication, rate limits and request-size limits. 3) Reject or constrain prompt-embeds inputs and penalty parameters (presence, frequency, repetition) from untrusted clients if your use case does not need them. 4) Run vLLM under a supervisor (Kubernetes, systemd) with automatic restart and health checks, and use several replicas behind a load balancer. 5) Detection: alert on engine crashes, repeated restarts, stack traces from vllm/model_executor/layers/utils.py, and unusual request patterns with penalty parameters from a single account. 6) Use per-tenant quotas and isolation so one user cannot take down shared capacity.

How is it classified?

DoSInferenceAPIAML.T0029- Denial of AI Service AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-105922?

Is CVE-2026-105922 actively exploited?

No confirmed active exploitation of CVE-2026-105922 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-105922?

1) Check for upstream fix or advisory in vllm-project/vllm issue #57719 and upgrade to the first release above 0.31.0 that addresses it. 2) Until then, put an API gateway or reverse proxy in front of vLLM that enforces authentication, rate limits and request-size limits. 3) Reject or constrain prompt-embeds inputs and penalty parameters (presence, frequency, repetition) from untrusted clients if your use case does not need them. 4) Run vLLM under a supervisor (Kubernetes, systemd) with automatic restart and health checks, and use several replicas behind a load balancer. 5) Detection: alert on engine crashes, repeated restarts, stack traces from vllm/model_executor/layers/utils.py, and unusual request patterns with penalty parameters from a single account. 6) Use per-tenant quotas and isolation so one user cannot take down shared capacity.

What systems are affected by CVE-2026-105922?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference endpoints, RAG pipelines, agent frameworks, multi-tenant AI platforms.

What is the CVSS score for CVE-2026-105922?

CVE-2026-105922 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.31%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inference endpointsRAG pipelinesagent frameworksmulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker with a low-privilege account or API key on an internal or SaaS LLM platform backed by vLLM adapts the public repro script. They send a request that supplies prompt embeds together with sampling penalty settings, which makes the penalty handler fail and crashes the engine. They repeat the request each time the service restarts, keeping the inference endpoint down for all users and disrupting downstream applications such as chatbots, RAG pipelines and agents.

Weaknesses (CWE)

CWE-404Improper Resource Shutdown or ReleasePrimary CWE-404Improper Resource Shutdown or Release

CWE-404 — Improper Resource Shutdown or Release: The product does not release or incorrectly releases a resource before it is made available for re-use.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
[Implementation] It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.

Source: MITRE CWE corpus.