CVE-2026-116181Medium· 6.5▾ SunlitA flaw was found in vllm. An authenticated remote attacker could cause a Denial of Service (DoS) or memory corruption by submitting requests containing invalid stop token identifiers. Because the application does not verify whether provide…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
A flaw was found in vllm. An authenticated remote attacker could cause a Denial of Service (DoS) or memory corruption by submitting requests containing invalid stop token identifiers. Because the application does not verify whether provided stop tokens fall within the model's vocabulary range, indexing these values can crash the inference engine or trigger an out-of-bounds write in GPU memory.
vllm: vllm: Denial of Service via unvalidated stop token identifiers — rated Moderate by Red Hat. Released 2026-10-25.
Affected:
No fix planned:
Fix deferred
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109250Medium· 6.6FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration
CVE-2026-33815High· 8.3github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33815)
CVE-2026-116124High· 7.8libgsf: libgsf: Arbitrary code execution via heap-based buffer overflow in OLE2 parser (CVE-2026-116124)
CVE-2026-116149High· 7.8ImageMagick: ImageMagick: Memory corruption via crafted bzip2 compressed images (CVE-2026-116149)
CVE-2026-116153Low· 2.5ImageMagick: ImageMagick: Denial of Service via heap-based buffer overflow in convex-hull calculations (CVE-2026-116153)
CVE-2026-116160Low· 3.3ImageMagick: ImageMagick: Denial of Service via crafted image in X11 animate operation (CVE-2026-116160)