vLLM bad_words token-index validation gap corrupts logits memory across concurrent requests

NVD published CVE-2026-93989 on 2026-09-19 (CVSS 3.1, CWE-129 improper array-index validation). The flaw is in bad-words token handling in the vLLM sampling path; a fix is being tracked in a vLLM PR. Exploitation is complex (requires crafted tokenizer input) but affects concurrent requests in shared deployments.

For multi-tenant or shared vLLM serving, this is a cross-request memory-integrity flaw in a core inference component — a low-severity but real class of 'GPU logits corruption' issue that can leak/corrupt another tenant's generation output. Part of a pattern of memory-safety gaps in vLLM's sampling path surfaced through 2026.

An authenticated caller (or one able to reach the serving API) supplies out-of-bounds bad_words token indices that are not validated against the model's generation output width, causing out-of-bounds writes that corrupt logits memory of other in-flight HTTP requests, making them return incorrect tokens.

vLLM through 0.29.0 (SamplingParams.update_from_tokenizer / bad_words.py)

Upgrade past vLLM 0.29.0 when the fix lands (tracked in vLLM PR #48824); restrict who can supply sampling parameters on exposed endpoints. https://www.vulncheck.com/advisories/vllm-through-0.29.0-cross-request-logits-corruption-via-bad-words