https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 20:57:28 +0000 https://db.gcve.eu/vuln/cve-2026-114049 <p><strong>Affected:</strong> vllm-project vllm</p> <p>vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients&#39; outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycled batch slots apply their token allowlist to victims&#39; unrestricted requests.</p> <p><strong>Affected:</strong> vllm-project vllm</p> <p>vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients&#39; outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycled batch slots apply their token allowlist to victims&#39; unrestricted requests.</p> https://db.gcve.eu/vuln/cve-2026-114049