CVE-2026-90713

Description

A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/src/backend/hf/mod.rs of the component tiktoken vocab File Handler. The manipulation results in denial of service. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

References

https://vuldb.com/vuln/403267/cti

https://vuldb.com/vuln/403267

https://vuldb.com/submit/918762

https://vuldb.com/cve/CVE-2026-90713

https://github.com/vllm-project/vllm/pull/51135

https://github.com/vllm-project/vllm/issues/50954

https://github.com/vllm-project/vllm/

https://gist.github.com/Yunzez/4b08ec3568a8cbfb120062e2558382b8

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4