Nine vLLM flaws let one request crash a server or corrupt other users' output

What happened

Nine CVE records against vLLM reached NVD on 18, 19 and 21 September 2026, all reachable through ordinary inference requests. The six of 21 September hit disaggregated serving: an incomplete kv_transfer_params entry, a multi-prompt request, unbounded peer sessions or an unchecked tp_size value kills or exhausts the decode worker. The request paths are exposed through the serving API; deployments with API authentication require valid credentials. Five score CVSS 3.1 7.5. The other three let one caller corrupt sampler state shared with concurrent requests, changing what other users' requests return: CVE-2026-93840 (allowed_token_ids) and CVE-2026-93841 (the Triton penalty kernel), both 3.7, and CVE-2026-93989 (bad_words), 3.1.

CVE-2026-93840 is fixed in vLLM 0.29.0. The other eight list every release through 0.29.0 as affected and name a fix pull request for each. They follow the four-advisory vLLM batch of 12 September and the max_tokens=0 flaw of 17 September on this board, in the same serving paths. vLLM 0.30.0 shipped on 22 September, and as of 2 October 2026 no fixed release was confirmed for the other eight: NVD's analysed records still list every release through 0.29.0 as affected. The maintainer’s 20 October advisory for CVE-2026-94624 identifies vLLM 0.32.0 as patched and describes socket exhaustion in P2P secondary-tier offloading. The reproduced path used a normal API key and required that offloading configuration.