Vulnpedia
← Search CVEs

CVE-2026-105922

MEDIUM 5.3

Published 2026-10-06 · Last modified 2026-10-06

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 24th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

5.3CVSS 4.0 · MEDIUM

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityLow

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Vllm Project Vllm

Products Vllm

Weakness (CWE)

  • CWE-404: Denial of Service

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • vllm PyPI

    pkg:pypi/vllm

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.32.0
    99 explicitly listed affected versions

    0.0.1, 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.10.0, 0.10.1, 0.10.1.1, 0.10.2, 0.11.0, 0.11.1, 0.11.2, 0.12.0, 0.13.0, 0.14.0, 0.14.1, 0.15.0, 0.15.1, 0.16.0, 0.17.0, 0.17.1, 0.18.0, 0.18.1, 0.19.0, 0.19.1, 0.2.0, 0.2.1, 0.2.1.post1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.20.0, 0.20.1, 0.20.2, 0.21.0, 0.22.0, 0.22.1, 0.23.0, 0.24.0, 0.25.0, 0.25.1, 0.26.0, 0.27.0, 0.27.1, 0.28.0, 0.29.0, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.30.0, 0.31.0, 0.4.0, 0.4.0.post1, 0.4.1, 0.4.2, 0.4.3, 0.5.0, 0.5.0.post1, 0.5.1, 0.5.2, 0.5.3, 0.5.3.post1, 0.5.4, 0.5.5, 0.6.0, 0.6.1, 0.6.1.post1, 0.6.1.post2, 0.6.2, 0.6.3, 0.6.3.post1, 0.6.4, 0.6.4.post1, 0.6.5, 0.6.6, 0.6.6.post1, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.5, 0.8.5.post1, 0.9.0, 0.9.0.1, 0.9.1, 0.9.2

    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://github.com/pypa/advisory-database/blob/main/vulns/vllm/PYSEC-2026-4319.yaml"
  }
}
    PyPA · PYSEC-2026-4319 · Updated 2026-10-18T13:45:02.439769873Z

Vendor product assessments

  • rhaii/vllm-cpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cpu-rhel9@sha256:81c5994dc20321f8bd3969099eade78ef127cbd79f2d0ccea101c773e4c7fa4d?repository_url=registry.redhat.io/rhaii/vllm-cpu-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhaii/vllm-cuda-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cuda-rhel9@sha256:0d22e2301ce26ef68effda5d3a4a20381ad0ea34d1240e159e245bd44c2e125b?repository_url=registry.redhat.io/rhaii/vllm-cuda-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhaii/vllm-gaudi-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-gaudi-rhel9@sha256:ce1e4fd82dd37d299ce8c64a237971d00faf602f06868c986e81aefa04c283ef?repository_url=registry.redhat.io/rhaii/vllm-gaudi-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhaii/vllm-neuron-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-neuron-rhel9@sha256:1079c9afecdbc33f4790792f0d712dbf7523790a92dcfbe8fb5cf4c2d282fc5b?repository_url=registry.redhat.io/rhaii/vllm-neuron-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhaii/vllm-rocm-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-rocm-rhel9@sha256:1a30359d6ca5d0891e403b9b0a23c0ae1ad6e30a2429b9b42e246b874fe8859a?repository_url=registry.redhat.io/rhaii/vllm-rocm-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhaii/vllm-spyre-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-spyre-rhel9@sha256:11ad6e13c41728944d933c7abe01d1d10ecb3f8e8b4f0da50ec53b7df6f036a8?repository_url=registry.redhat.io/rhaii/vllm-spyre-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhaii/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-tpu-rhel9@sha256:0c2ac747d67dc0e80162ff05867dd702e474b2217659f19f28b8e3a0c03a942a?repository_url=registry.redhat.io/rhaii/vllm-tpu-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhaiis/vllm-cuda-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cuda-rhel9@sha256:73bbc4560132c4aaa9bbd608ce9560eeae7b30bcc8f014da460afa5622139372?repository_url=registry.redhat.io/rhaiis/vllm-cuda-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhaiis/vllm-rocm-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-rocm-rhel9@sha256:37b64a8df90756aae0ee96d2f07765adbce5ed5beb2414ac3845806ad2219cfc?repository_url=registry.redhat.io/rhaiis/vllm-rocm-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhaiis/vllm-spyre-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-spyre-rhel9@sha256:3dd7eff1c62cd4609b4c76590b77bb801cd064e40642ed32b5aa900a6bc643ea?repository_url=registry.redhat.io/rhaiis/vllm-spyre-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhaiis/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-tpu-rhel9@sha256:b1c12112a1e8a298645e10d34d44c9961a6121aa8d87fc5d65ad83e1ffa3c586?repository_url=registry.redhat.io/rhaiis/vllm-tpu-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhelai3/bootc-aws-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-aws-cuda-rhel9@sha256:06b1e9b7df858121b6f339a5e78de93307be96c191a1c3e6df50cfeffaf9df15?repository_url=registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhelai3/bootc-azure-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-azure-cuda-rhel9@sha256:698d9e34aaf479d0149ea75b841dacbe0117ba2e3718a7088ac98ea6b081792e?repository_url=registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhelai3/bootc-azure-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-azure-rocm-rhel9@sha256:87723c21f48eb371968e2d68346953f2a03a3cf643a967801b84696ee3e1f1e8?repository_url=registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-cuda-rhel9@sha256:e0fbb896811ab54d183e23612030072b946674824bad697bf2b3f68362651662?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhelai3/bootc-gaudi-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-gaudi-rhel9@sha256:e1057b59ca1be9501332abf97230855e85c7df858356be0da9dce230ea7e98e1?repository_url=registry.redhat.io/rhelai3/bootc-gaudi-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhelai3/bootc-gcp-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-gcp-cuda-rhel9@sha256:c1a193fa047eedbbf52be0b1d0f5d52e3e572d144a871f7c9322a34ba5abd92f?repository_url=registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhelai3/bootc-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-rocm-rhel9@sha256:8fe5203e86917e5f829bd64b831cad31536d23a213b4bfe31e652577ad0faf2e?repository_url=registry.redhat.io/rhelai3/bootc-rocm-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhoai/odh-kserve-agent-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-agent-rhel9@sha256:cb2396d837f6249c85d55e118b61729e6c59cfb5a2bd45a0cf31867cb3f00cfc?repository_url=registry.redhat.io/rhoai/odh-kserve-agent-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhoai/odh-kserve-controller-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-controller-rhel9@sha256:344c4225761bc681101b7597088f7c23d43cac7ca09c24edb1f1c38e4b493059?repository_url=registry.redhat.io/rhoai/odh-kserve-controller-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhoai/odh-kserve-router-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-router-rhel9@sha256:03c98651276c00e36133c1926d90738940703cd12b2d47e5a3aa865e4c1872af?repository_url=registry.redhat.io/rhoai/odh-kserve-router-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhoai/odh-kserve-storage-initializer-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-kserve-storage-initializer-rhel9@sha256:48619d144fdf453a2ed670694d732ac71f7a3df00951dbdf62ee41a084f646cd?repository_url=registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhoai/odh-llm-d-kv-cache-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-llm-d-kv-cache-rhel9@sha256:cb5eedeefd2578cd9bd8637250bbe299c84539f57b4ead75d630ed9f833a6ef2?repository_url=registry.redhat.io/rhoai/odh-llm-d-kv-cache-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • none available: Affected
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhoai/odh-vllm-gaudi-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-vllm-gaudi-rhel9@sha256:87eec3862eb6ddef445f89dcf6fd89add7ef202ea7c563b1ee7347537fb3e250?repository_url=registry.redhat.io/rhoai/odh-vllm-gaudi-rhel9

    • workaround: Restrict network reachability of the vLLM inference service to authorized networks or localhost to prevent untrusted callers from submitting malicious queries. On standalone host environments, restrict access to the inference port (default 8000/tcp) using firewalld: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_network>" port port="8000" protocol="tcp" accept' firewall-cmd --permanent --remove-port=8000/tcp firewall-cmd --reload In Red Hat OpenShift AI environments, configure NetworkPolicies to isolate the model-serving pods and restrict ingress traffic exclusively to trusted internal gateways or authorized namespaces. Caveats: Restricting endpoint reachability blocks external or unauthorized systems from interacting with served models. Warning: Executing `firewall-cmd --reload` reloads the active firewall configuration and may momentarily interrupt existing network connections.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhaiis/vllm-cpu-rhel9 as a component of Red Hat AI Inference Server · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/vllm-cpu-rhel9@sha256:fb7791bbfea99e9f81529fe8cc1e7c834ca470585c27590e3d0a6834167cd436?repository_url=registry.redhat.io/rhaiis/vllm-cpu-rhel9

    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhaiis/vllm-neuron-rhel9 as a component of Red Hat AI Inference Server · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/vllm-neuron-rhel9@sha256:8ba72cec5d79b1a751eb09774c81fd6181b43ec69a2e5116982661b34366874d?repository_url=registry.redhat.io/rhaiis/vllm-neuron-rhel9

    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00
  • rhoai/odh-th-torch-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not in execute path

    pkg:oci/odh-th-torch-cuda-py312-rhel9@sha256:efd7b3607b699092c68359d20ef0d0043114191a097637667c0d2cf78fbea702?repository_url=registry.redhat.io/rhoai/odh-th-torch-cuda-py312-rhel9

    Red Hat · CVE-2026-105922 · Updated 2026-10-20T17:53:36+00:00

Known Affected Software Configurations

VendorProductVersion range
VllmVllm≤ 0.31.0

All CVSS metrics

  • MEDIUM 5.3 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
  • MEDIUM 4.3 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C
  • MEDIUM 4.3 v3.0 · CNA Primary
    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C
  • MEDIUM 4 v2.0 · CNA Primary
    AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C
  • LOW 2.1 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • MEDIUM 4.3 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
  • MEDIUM 4 v2.0 · NVD Secondary
    AV:N/AC:L/Au:S/C:N/I:N/A:P

References

Exploit-tagged references (not proof of a PoC)

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS