{"id":"GHSA-6pgw-f3pv-4h8q","kind":"vulnerability","aliases":["GHSA-6pgw-f3pv-4h8q"],"related":[],"title":"Rust gRPC output_candidates.token_ids bypasses logprob_token_ids limits and can terminate EngineCore","description":"## Summary\n\nThe Rust gRPC `Generate` and `GenerateStream` API accepts `ResponseOptions.output_candidates.token_ids` and lowers the supplied list directly into `SamplingParams.logprob_token_ids` without enforcing the Python `SamplingParams` validator.\n\nPython explicitly caps `logprob_token_ids` at `MAX_LOGPROB_TOKEN_IDS = 128`, range-checks each token ID against model vocabulary, and requires `logprobs == len(logprob_token_ids)` when both are set. The V1 GPU logprob sampler allocates a fixed `(max_num_reqs, MAX_LOGPROB_TOKEN_IDS)` row and raises `ValueError` if a request carries more than 128 `logprob_token_ids`.\n\nThe Rust gRPC converter bypasses that intended guard. A caller can request output logprobs with 129 or more explicit candidate token IDs. The Rust frontend accepts the request, stores the unbounded list in `SamplingParams`, and sends it toward the Python engine-core boundary, where the lower sampler path can raise after the request has entered execution. EngineCore treats uncaught worker exceptions as fatal engine errors.\n\n## Technical Details\n\nThe protobuf exposes explicit output candidate token IDs:\n\n```proto\noptional CandidateTokens output_candidates = 7;\n\nmessage CandidateTokens {\n  oneof select {\n    uint32 top_n = 1;\n    TokenIds token_ids = 2;\n    bool all = 3;\n  }\n}\n```\n\nThe Rust gRPC converter maps `output_candidates.token_ids` directly into `SamplingParams.logprob_token_ids`:\n\n```rust\nif r.output_logprobs {\n    let (count, token_ids) = candidate_logprob_spec(r.output_candidates.as_ref());\n    params.logprobs = Some(count);\n    params.logprob_token_ids = token_ids;\n}\n\nSome(pb::candidate_tokens::Select::TokenIds(ids)) => (1, Some(ids.ids.clone())),\n```\n\nThere is no length check against `MAX_LOGPROB_TOKEN_IDS`, no vocabulary range-check, and no `logprobs == len(logprob_token_ids)` consistency check.\n\nBy contrast, Python `SamplingParams` explicitly rejects the same unsafe state:\n\n```python\nMAX_LOGPROB_TOKEN_IDS = 128\n\"\"\"Upper bound on `SamplingParams.logprob_token_ids` list length. Must match\nthe per-request row width allocated by the sampler's `LogprobTokenIdsState`.\"\"\"\n\nif self.logprob_token_ids is not None:\n    n = len(self.logprob_token_ids)\n    if n > MAX_LOGPROB_TOKEN_IDS:\n        raise VLLMValidationError(...)\n```\n\nThe lower GPU logprob sampler confirms this is not only a presentation-layer preference. It allocates a fixed-width row and raises if an oversized list reaches `add_request()`:\n\n```python\nself.token_ids = StagedWriteTensor(\n    (max_num_reqs, MAX_LOGPROB_TOKEN_IDS),\n    dtype=torch.int32,\n    device=device,\n)\n\nif n > MAX_LOGPROB_TOKEN_IDS:\n    raise ValueError(\n        f\"Too many logprob_token_ids: {n}. The max is {MAX_LOGPROB_TOKEN_IDS}.\"\n    )\n```\n\nThe intended behavior is visible in three independent places.\n\nFirst, the Python API documents and enforces `MAX_LOGPROB_TOKEN_IDS = 128`, with the comment that the bound must match the sampler row width.\n\nSecond, the Rust gRPC converter already recognizes that candidate token ID selectors need special handling. It explicitly rejects `prompt_candidates.token_ids` with `INVALID_ARGUMENT` because the shared engine-core protocol cannot safely represent separate prompt candidate IDs:\n\n```rust\n\"prompt_candidates token_ids selector is not supported\"\n```\n\nThird, the lower sampler path is fixed-width and has a defensive runtime check. Allowing Rust gRPC to bypass the northbound validator and rely on a late worker exception is the unsafe state; the correct behavior is early request validation.\n\nThis is also distinct from the previously submitted Rust gRPC prompt token-ID range issue (`this report` / `GHSA-w2v2-5662-8v5q`). That report covers out-of-vocabulary prompt IDs submitted as the request prompt. This report covers the output-logprob candidate selector lowering into `SamplingParams.logprob_token_ids` with no count, vocabulary, or consistency validation.\n\n## Impact\n\nAn attacker who can reach a vLLM Rust gRPC endpoint can submit a generation request with `output_logprobs = true` and `output_candidates.token_ids` containing more than 128 IDs.\n\nExpected impact is a single-request denial of service for affected deployments: the request is accepted by the Rust gRPC frontend, reaches the engine logprob sampler state, and can terminate EngineCore. Fixed behavior should be an immediate `INVALID_ARGUMENT` response before any engine request is submitted.\n\nThis report does not claim code execution, data access, model compromise, persistence, or public internet exposure. It is an availability issue caused by missing Rust gRPC input validation.\n\nSuggested severity: High if the Rust gRPC endpoint is network-reachable without an additional deployment-layer credential requirement.\n\nSuggested CVSS v3.1:\n\n```text\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n```\n\nIf maintainers model the affected gRPC surface as reachable only to already-authorized clients, the conservative score is:\n\n```text\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n```\n\nSuggested CWEs:\n\n- `CWE-20`: Improper Input Validation\n- `CWE-400`: Uncontrolled Resource Consumption\n- `CWE-770`: Allocation of Resources Without Limits or Throttling\n\n## Suggested Fix\n\nValidate `ResponseOptions.output_candidates.token_ids` before assigning `params.logprob_token_ids`.\n\nRecommended patch shape:\n\n- define or import a Rust-side equivalent of `MAX_LOGPROB_TOKEN_IDS = 128`;\n- reject `output_candidates.token_ids` when `ids.len() > MAX_LOGPROB_TOKEN_IDS`;\n- range-check each supplied token ID against the served model vocabulary;\n- keep `params.logprobs` consistent with the explicit ID count, or reject inconsistent combinations instead of lowering them;\n- return `Status::invalid_argument(...)` from the gRPC converter before any engine request is submitted; and\n- add unary `Generate` and streaming `GenerateStream` regression tests for 128 accepted IDs, 129 rejected IDs, and out-of-vocabulary candidate IDs.\n\nThe same fix should preserve the existing `prompt_candidates.token_ids` rejection unless maintainers add a safe protocol representation for it.\n\n## References\n\n- vLLM security policy: `https://github.com/vllm-project/vllm/security`\n- vLLM vulnerability management: `https://docs.vllm.ai/en/latest/contributing/vulnerability_management/`\n- vLLM security guide: `https://docs.vllm.ai/en/latest/usage/security/`\n- vLLM `SamplingParams` API docs: `https://docs.vllm.ai/en/latest/api/vllm/sampling_params/`\n- vLLM logprob sampler API docs: `https://docs.vllm.ai/en/stable/api/vllm/v1/worker/gpu/sample/logprob/`\n\n## Appendix: Duplicate Review\n\nI checked local vLLM submission bundles, private-visible vLLM advisories, and GitHub PR/issue search for `logprob_token_ids`, `CandidateTokens`, `output_candidates`, `ResponseOptions`, and gRPC logprob variants.\n\nNearby but distinct:\n\n- `this report` / `GHSA-w2v2-5662-8v5q`: Rust gRPC accepts out-of-vocabulary `prompt.token_ids`. That is a prompt-token range-validation bug. It does not package the `output_candidates.token_ids` length bypass or `LogprobTokenIdsState` fixed-row failure path.\n- `this report` / `GHSA-mmrv-74wf-6pxm`: Rust frontend sampler-control length bounds remain missing after PR `#45390`. This report is narrower and covers the gRPC response-candidate selector that bypasses the explicit `logprob_token_ids` Python validator.\n\nThe GitHub advisory API returned only the prior this report gRPC prompt-token advisory for these terms. Public GitHub PR and issue searches for the exact candidate-selector/logprob-token path returned no matches.\n\n## Affected versions\n\n- Package: `vllm` (PyPI).\n- Affected versions: `>= 0.22.0, < 0.24.0`.\n- First stable patched version: `0.24.0`.\n\nAdvisory fixed in [#45674](https://github.com/vllm-project/vllm/pull/45674).","summary":"The vLLM Rust gRPC Generate and GenerateStream endpoints accept more than 128 output candidate token IDs without the validation the Python API enforces. A single request with output logprobs enabled can make the engine core terminate, which is a denial of service.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vllm","fixed":["0.24.0"],"affected":">= 0.22.0, < 0.24.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-20","cwe-400","cwe-770","grpc","python","self-hosted","vllm"],"not_affected_if":["default-config","no-grpc-frontend"],"how_to_check":"- Check the installed vLLM version with `pip show vllm`; versions `>= 0.22.0, < 0.24.0` are affected.\n- Check whether the Rust gRPC frontend is enabled and reachable from the network.","fix":"- Upgrade `vllm` to `0.24.0`.","status":"open","published_at":"2026-10-09T07:47:33+00:00","first_seen_at":"2026-11-09T22:53:23+00:00","triaged_at":"2026-11-09T23:01:03+00:00","updated_at":"2026-11-09T23:01:03+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T23:01:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `vllm` to `0.24.0`.","reach":"network","title":"vLLM: oversized logprob candidate list via Rust gRPC crashes EngineCore","impact":"low","summary":"The vLLM Rust gRPC Generate and GenerateStream endpoints accept more than 128 output candidate token IDs without the validation the Python API enforces. A single request with output logprobs enabled can make the engine core terminate, which is a denial of service.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["vllm","python","self-hosted","grpc"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"A single request crashes the EngineCore process, causing denial of service.","analyst_note":"","how_to_check":"- Check the installed vLLM version with `pip show vllm`; versions `>= 0.22.0, < 0.24.0` are affected.\n- Check whether the Rust gRPC frontend is enabled and reachable from the network.\n- unknown whether a default configuration exposes the gRPC endpoint.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","no-grpc-frontend"],"who_is_affected":"Teams that run vLLM with the Rust gRPC frontend reachable by clients, where a request can set output logprobs with explicit candidate token IDs. The sources state the attack needs only an unauthenticated request in the default case, though the advisory also models a conservative case where clients must be authorized. Deployments that do not expose the gRPC endpoint, or that restrict it behind a credential layer, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.001084,"input_tokens":7744,"output_tokens":620,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-20':29B '-400':31B '-770':33B '-8':602C '1':259C,307C '128':51B,120C,166C,349C,480C '129':185C '2':263C '3':266C '4h8q':18A,23A '5662':601C '6pgw':16A,21A '7':251C 'accept':48B,90C,195C 'add':421C 'ai':26B 'ai-tool':25B 'alloc':146C,366C,408C 'allow':554C 'alreadi':498C 'also':582C 'api':61B,89C,472C 'argument':515C 'attack':641C 'behavior':462C,575C 'bool':264C 'bound':351C,486C 'boundari':213C 'bypass':5A,174C,558C 'caller':179C 'candid':53B,189C,243C,250C,287C,302C,501C,528C,532C,625C 'candidatetoken':248C,253C 'cannot':523C 'cap':111C 'carri':163C 'check':123C,314C,324C,333C,553C 'comment':483C 'confirm':397C 'consist':332C,637C 'contrast':335C 'convert':173C,270C,497C 'core':74B,212C,521C 'correct':574C 'count':284C,294C,634C 'cover':606C,620C 'cwe':28B,30B,32B 'defens':551C 'denial':79B 'detail':237C 'devic':436C,437C 'direct':98C,274C 'distinct':583C 'document':473C 'dtype':434C 'earli':577C 'enabl':69B 'endpoint':47B,649C 'enforc':62B,104C,475C 'engin':73B,211C,234C,520C 'engine-cor':210C,519C 'enginecor':13A,227C 'enter':225C 'error':235C 'except':231C,568C 'execut':226C 'explicit':110C,188C,241C,338C,509C 'expos':240C 'f':446C 'f3pv':17A,22A 'fatal':233C 'first':469C 'fix':148C,411C,546C 'fixed-width':410C,545C 'frontend':194C 'generat':44B,86C,653C 'generatestream':46B,88C 'ghsa':15A,20A,599C 'ghsa-6pgw-f3pv-4h8q':14A,19A 'ghsa-w2v2':598C 'gpu':143C,394C 'grpc':2A,34B,43B,85C,172C,269C,496C,556C,589C,648C 'guard':177C 'handl':507C 'host':38B 'id':4A,8A,55B,92C,102C,114C,119C,126C,136C,155C,169C,191C,245C,262C,273C,278C,286C,297C,299C,306C,319C,331C,348C,355C,375C,383C,389C,425C,433C,443C,451C,459C,479C,503C,512C,529C,534C,593C,612C,631C 'ids.ids.clone':309C 'impact':639C 'independ':467C 'intend':176C,461C 'invalid':514C 'issu':595C 'late':566C 'layer':405C 'len':133C,328C,380C 'length':313C,357C 'let':283C 'limit':9A 'list':97C,201C,356C,419C 'logprob':6A,68B,112C,117C,132C,134C,144C,153C,167C,183C,282C,288C,317C,327C,329C,346C,387C,395C,431C,441C,449C,457C,477C,624C 'logprobtokenidsst':371C 'lower':94C,216C,393C,541C,627C 'make':71B 'mani':448C 'map':271C 'match':359C,488C 'max':116C,149C,152C,316C,345C,386C,427C,430C,440C,454C,456C,476C 'messag':252C 'model':128C 'must':358C,487C 'n':258C,379C,385C,439C,452C 'need':505C 'none':378C 'northbound':560C 'num':150C,428C 'oneof':254C 'option':247C 'out-of-vocabulari':607C 'output':52B,67B,182C,242C,249C,623C 'output-logprob':622C 'output_candidates.token':3A,272C 'overs':418C 'params.logprob':295C 'params.logprobs':292C 'path':218C,543C 'pb':301C 'per':362C 'per-request':361C 'place':468C 'prefer':406C 'present':404C 'presentation-lay':403C 'previous':586C 'prompt':527C,531C,590C,611C,617C 'prompt_candidates.token':511C 'proto':246C 'protobuf':239C 'protocol':522C 'python':35B,60B,106C,109C,209C,336C,344C,423C,471C 'r.output':281C 'r.output_candidates.as':290C 'rais':158C,220C,390C,415C,444C 'rang':122C,323C,594C 'range-check':121C,322C 'reach':420C,644C 'recogn':499C 'ref':291C 'reject':339C,510C 'reli':563C 'report':597C,605C,619C 'repres':525C 'req':151C,429C 'request':65B,162C,181C,197C,223C,363C,422C,578C,616C,654C 'requir':131C 'responseoptions.output_candidates.token':91C 'row':156C,364C,413C,491C 'runtim':552C 'rust':1A,42B,84C,171C,193C,268C,279C,495C,530C,555C,588C,647C 'safe':524C 'sampler':145C,217C,369C,396C,490C,542C 'samplingparam':107C,203C,337C 'samplingparams.logprob':100C,276C,353C,629C 'second':493C 'select':255C,304C 'selector':504C,535C,626C 'self':37B 'self-host':36B 'self.logprob':373C,381C 'self.token':424C 'send':205C 'separ':526C 'servic':81B 'set':140C 'share':518C 'singl':64B 'spec':289C 'special':506C 'stagedwritetensor':426C 'state':343C,572C 'store':198C 'submit':587C,613C,651C 'summari':82C 'suppli':96C 'support':538C 'technic':236C 'termin':12A,75B 'third':539C 'three':466C 'token':7A,54B,101C,113C,118C,125C,135C,154C,168C,190C,244C,261C,277C,285C,296C,298C,303C,318C,330C,347C,354C,374C,382C,388C,432C,442C,450C,458C,478C,502C,533C,592C,630C 'token-id':591C 'tokenid':260C,305C 'tool':27B 'top':257C 'torch.int32':435C 'toward':207C 'treat':228C 'uint32':256C 'unbound':200C 'uncaught':229C 'unsaf':342C,571C 'upper':350C 'v1':142C 'v5q':603C 'valid':58B,108C,561C,579C,638C 'valueerror':159C,445C 'visibl':464C 'vllm':24A,39B,41B,646C 'vllmvalidationerror':391C 'vocabulari':129C,321C,610C,635C 'w2v2':600C 'width':365C,412C,492C,547C 'wit':655C 'without':56B,103C 'worker':230C,567C","nicknames":[],"mitigations":[],"who_affected":"Teams that run vLLM with the Rust gRPC frontend reachable by clients, where a request can set output logprobs with explicit candidate token IDs. The sources state the attack needs only an unauthenticated request in the default case, though the advisory also models a conservative case where clients must be authorized. Deployments that do not expose the gRPC endpoint, or that restrict it behind a credential layer, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["vllm"],"ptokens":["vllm"],"labels":["aitooling","cwe20","cwe400","cwe770","grpc","medium","pypi","python","selfhosted","vllm"],"campaign_type":null,"search_a":"'4h8q':18A,23A '6pgw':16A,21A 'bypass':5A 'enginecor':13A 'f3pv':17A,22A 'ghsa':15A,20A 'ghsa-6pgw-f3pv-4h8q':14A,19A 'grpc':2A 'id':4A,8A 'limit':9A 'logprob':6A 'output_candidates.token':3A 'rust':1A 'termin':12A 'token':7A 'vllm':24A","search_b":"'-20':29B '-400':31B '-770':33B '128':51B 'accept':48B 'ai':26B 'ai-tool':25B 'api':61B 'candid':53B 'core':74B 'cwe':28B,30B,32B 'denial':79B 'enabl':69B 'endpoint':47B 'enforc':62B 'engin':73B 'generat':44B 'generatestream':46B 'grpc':34B,43B 'host':38B 'id':55B 'logprob':68B 'make':71B 'output':52B,67B 'python':35B,60B 'request':65B 'rust':42B 'self':37B 'self-host':36B 'servic':81B 'singl':64B 'termin':75B 'token':54B 'tool':27B 'valid':58B 'vllm':39B,41B 'without':56B","search_c":"'-8':602C '1':259C,307C '128':120C,166C,349C,480C '129':185C '2':263C '3':266C '5662':601C '7':251C 'accept':90C,195C 'add':421C 'alloc':146C,366C,408C 'allow':554C 'alreadi':498C 'also':582C 'api':89C,472C 'argument':515C 'attack':641C 'behavior':462C,575C 'bool':264C 'bound':351C,486C 'boundari':213C 'bypass':174C,558C 'caller':179C 'candid':189C,243C,250C,287C,302C,501C,528C,532C,625C 'candidatetoken':248C,253C 'cannot':523C 'cap':111C 'carri':163C 'check':123C,314C,324C,333C,553C 'comment':483C 'confirm':397C 'consist':332C,637C 'contrast':335C 'convert':173C,270C,497C 'core':212C,521C 'correct':574C 'count':284C,294C,634C 'cover':606C,620C 'defens':551C 'detail':237C 'devic':436C,437C 'direct':98C,274C 'distinct':583C 'document':473C 'dtype':434C 'earli':577C 'endpoint':649C 'enforc':104C,475C 'engin':211C,234C,520C 'engine-cor':210C,519C 'enginecor':227C 'enter':225C 'error':235C 'except':231C,568C 'execut':226C 'explicit':110C,188C,241C,338C,509C 'expos':240C 'f':446C 'fatal':233C 'first':469C 'fix':148C,411C,546C 'fixed-width':410C,545C 'frontend':194C 'generat':86C,653C 'generatestream':88C 'ghsa':599C 'ghsa-w2v2':598C 'gpu':143C,394C 'grpc':85C,172C,269C,496C,556C,589C,648C 'guard':177C 'handl':507C 'id':92C,102C,114C,119C,126C,136C,155C,169C,191C,245C,262C,273C,278C,286C,297C,299C,306C,319C,331C,348C,355C,375C,383C,389C,425C,433C,443C,451C,459C,479C,503C,512C,529C,534C,593C,612C,631C 'ids.ids.clone':309C 'impact':639C 'independ':467C 'intend':176C,461C 'invalid':514C 'issu':595C 'late':566C 'layer':405C 'len':133C,328C,380C 'length':313C,357C 'let':283C 'list':97C,201C,356C,419C 'logprob':112C,117C,132C,134C,144C,153C,167C,183C,282C,288C,317C,327C,329C,346C,387C,395C,431C,441C,449C,457C,477C,624C 'logprobtokenidsst':371C 'lower':94C,216C,393C,541C,627C 'mani':448C 'map':271C 'match':359C,488C 'max':116C,149C,152C,316C,345C,386C,427C,430C,440C,454C,456C,476C 'messag':252C 'model':128C 'must':358C,487C 'n':258C,379C,385C,439C,452C 'need':505C 'none':378C 'northbound':560C 'num':150C,428C 'oneof':254C 'option':247C 'out-of-vocabulari':607C 'output':182C,242C,249C,623C 'output-logprob':622C 'output_candidates.token':272C 'overs':418C 'params.logprob':295C 'params.logprobs':292C 'path':218C,543C 'pb':301C 'per':362C 'per-request':361C 'place':468C 'prefer':406C 'present':404C 'presentation-lay':403C 'previous':586C 'prompt':527C,531C,590C,611C,617C 'prompt_candidates.token':511C 'proto':246C 'protobuf':239C 'protocol':522C 'python':106C,109C,209C,336C,344C,423C,471C 'r.output':281C 'r.output_candidates.as':290C 'rais':158C,220C,390C,415C,444C 'rang':122C,323C,594C 'range-check':121C,322C 'reach':420C,644C 'recogn':499C 'ref':291C 'reject':339C,510C 'reli':563C 'report':597C,605C,619C 'repres':525C 'req':151C,429C 'request':162C,181C,197C,223C,363C,422C,578C,616C,654C 'requir':131C 'responseoptions.output_candidates.token':91C 'row':156C,364C,413C,491C 'runtim':552C 'rust':84C,171C,193C,268C,279C,495C,530C,555C,588C,647C 'safe':524C 'sampler':145C,217C,369C,396C,490C,542C 'samplingparam':107C,203C,337C 'samplingparams.logprob':100C,276C,353C,629C 'second':493C 'select':255C,304C 'selector':504C,535C,626C 'self.logprob':373C,381C 'self.token':424C 'send':205C 'separ':526C 'set':140C 'share':518C 'spec':289C 'special':506C 'stagedwritetensor':426C 'state':343C,572C 'store':198C 'submit':587C,613C,651C 'summari':82C 'suppli':96C 'support':538C 'technic':236C 'third':539C 'three':466C 'token':101C,113C,118C,125C,135C,154C,168C,190C,244C,261C,277C,285C,296C,298C,303C,318C,330C,347C,354C,374C,382C,388C,432C,442C,450C,458C,478C,502C,533C,592C,630C 'token-id':591C 'tokenid':260C,305C 'top':257C 'torch.int32':435C 'toward':207C 'treat':228C 'uint32':256C 'unbound':200C 'uncaught':229C 'unsaf':342C,571C 'upper':350C 'v1':142C 'v5q':603C 'valid':108C,561C,579C,638C 'valueerror':159C,445C 'visibl':464C 'vllm':646C 'vllmvalidationerror':391C 'vocabulari':129C,321C,610C,635C 'w2v2':600C 'width':365C,412C,492C,547C 'wit':655C 'without':103C 'worker':230C,567C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-09T07:47:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-6pgw-f3pv-4h8q","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-6pgw-f3pv-4h8q","severity":"medium","published_at":"2026-10-09T07:47:33+00:00","modified_at":"2026-10-27T22:09:17+00:00","first_seen_at":"2026-11-09T22:53:23+00:00","fetched_at":"2026-11-09T22:53:23+00:00","note":null}],"documents":[{"id":47330,"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-6pgw-f3pv-4h8q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-09T07:47:33+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}