{"id":"GHSA-fpch-3xrf-7q96","kind":"vulnerability","aliases":["GHSA-fpch-3xrf-7q96"],"related":[],"title":"Thinking-budget sparse state aliases onto a co-batched request during a mixed `SWAP`, forcing the reasoning-end token into another request's output","description":"## Weakness\n\nCWE-488 (Exposure of Data Element to Wrong Session)\n\n## Affected\n\n- **Ecosystem / package:** pip / `vllm`\n- **Affected versions:** vLLM v0.21.0 through v0.27.1 when using the V1 model runner.\n- **Patched version:** v0.28.0.\n\n## Summary\n\n`thinking_token_budget` is a public sampling parameter on the OpenAI-compatible completion route. When the budget is reached, vLLM forces the configured reasoning-end token sequence (e.g. `</think>`) into the request's output. On the legacy V1 model runner this state is tracked in `ThinkingBudgetStateHolder`, a sparse dictionary keyed by mutable batch-row index.\n\n`ThinkingBudgetStateHolder.sync_batch()` implements its own row-move logic. Its `SWAP` branch reads both endpoints with `get()` and reassigns them, but never removes the source entries. When an attention backend reorders a mixed batch and only **one** side of a `SWAP` owns thinking-budget state, that state is copied to the destination row while the original row entry is left intact — so a single mutable state object is now aliased under two batch rows. The next sampling step treats both rows as owned by the budgeted request, and the forced-token sink drives the reasoning-end token into both.\n\nIn practice, one ordinary request can force the configured reasoning-end token sequence into another concurrent request's output when the two share a batch and a mixed reorder occurs. This is a cross-request integrity break visible to the victim. It is not code execution and no confidentiality impact is demonstrated.\n\n## Affected code\n\nLinks pinned to the confirmed commit [`752a3a504485`](https://github.com/vllm-project/vllm/tree/752a3a504485790a2e8491cacbb35c137339ad34) (v0.25.1):\n\n- [`vllm/v1/sample/thinking_budget_state.py` — `ThinkingBudgetStateHolder.sync_batch()` (L82-L115)](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#L82-L115). The buggy `SWAP` branch reads both endpoints with `get()` instead of popping them ([L101-L107](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#L101-L107)):\n\n```python\n# vllm/v1/sample/thinking_budget_state.py Lines 100-111\n        for i1, i2, direction in batch_update.moved:\n            if direction == MoveDirectionality.SWAP:\n                state1 = self._state.get(i1)\n                state2 = self._state.get(i2)\n                if state1 is not None:\n                    self._state[i2] = state1\n                if state2 is not None:\n                    self._state[i1] = state2\n            else:\n                state = self._state.pop(i1, None)\n                if state is not None:\n                    self._state[i2] = state\n```\n\nThe `SWAP` branch reads each endpoint with `get()` and reassigns, but never removes the source key. When only one endpoint owns state, that single mutable object ends up aliased under both `i1` and `i2`.\n\n- The forced-token sink iterates every sparse row whose state is in the reasoning-end phase ([`thinking_budget_state.py` — `_apply_forcing_to_logits()` force loop, L515-L556](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#L515-L556), writing at [L585](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#L585)); aliased state makes both rows receive the forced end token:\n\n```python\n# vllm/v1/sample/thinking_budget_state.py Lines 515-519\n        for seq_idx in sorted(self._state.keys()):\n            if seq_idx not in self.cu_num_tokens:\n                continue\n            state = self._state[seq_idx]\n            if state.get(\"in_end\", False):\n```\n\n```python\n# vllm/v1/sample/thinking_budget_state.py Lines 583-585\n                # Avoid CPU->GPU sync.\n                fill = logits.new_full((len(active_indices_cpu),), 1e9)\n                logits.index_put_((active_indices, force_tokens), fill)\n```\n\nBecause the loop keys on `self._state`, an aliased row is indistinguishable from a genuinely budgeted one: both are forced with `think_end_token_ids`.\n- [`vllm/v1/worker/gpu_input_batch.py` — `InputBatch.swap_states()` (L567-L642)](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/worker/gpu_input_batch.py#L567-L642) records the two-way `SWAP` move for row-indexed sampler state.\n- [`vllm/v1/attention/backends/utils.py` reorder loop (L729-L738)](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/attention/backends/utils.py#L729-L738) is the mixed-batch reorder that emits the `SWAP` (it cycle-walks `src_dest_map`, calling `input_batch.swap_states(src, dst)` at [L734](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/attention/backends/utils.py#L734)).\n- The correct shape already exists in the generic sparse-state helper: [`vllm/v1/sample/logits_processor/builtin.py` — `process_dict_updates()` SWAP branch (L315-L327)](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/logits_processor/builtin.py#L315-L327), which pops both endpoints before reassigning.\n- The parameter enters through [`vllm/entrypoints/openai/completion/protocol.py#L207`](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/entrypoints/openai/completion/protocol.py#L207) and is gated in [`vllm/v1/engine/input_processor.py#L102-L116`](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/engine/input_processor.py#L102-L116) (reasoning must be enabled; only the legacy runner is supported).\n\n## Impact\n\n**Preconditions:**\n\n- reasoning support is enabled and `reasoning_end_str` is configured;\n- the server runs Model Runner V1;\n- the attention backend takes a reorder path that emits a `SWAP`;\n- the attacker grooms the queue so a budgeted row and an unbudgeted victim row land on opposite sides of that swap.\n\nOnce the feature is enabled, a mixed batch swap can alias a budgeted request's state onto an unbudgeted request, forcing the configured reasoning-end sequence into the other request's output.\n\nThe primitive is precise but constrained: it forces the operator-configured `reasoning_end_str` (e.g. `</think>`) into the victim's output, not arbitrary tokens, and it requires the reorder path plus queue grooming. It is not backend-specific — any backend that produces the same mixed sparse swap is a candidate.\n\n## Credit\n\n**Reported by:** Patch the Planet (Trail of Bits + OpenAI collaboration)\n\nThis vulnerability was discovered using GPT-5.5-Cyber as part of the Patch the Planet security initiative.\n\nA fix for this was introduced in https://github.com/vllm-project/vllm/pull/49613.","summary":"When vLLM's thinking budget is reached, a row-move bug in the V1 sampler can copy one request's budget state onto a concurrent request in the same batch. The other request then has the configured reasoning-end token (such as </think>) forced into its output, a cross-request integrity break with no code execution shown.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vllm","fixed":["0.28.0"],"affected":">= 0.21.0, < 0.28.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-488","llm-serving","python","self-hosted","vllm"],"not_affected_if":["default-config","model-runner-v2","non-reasoning-models"],"how_to_check":"- Run `pip show vllm` and check whether the version is at least `0.21.0` and below `0.28.0`.\n- Check whether reasoning support is enabled with `reasoning_end_str` configured, and whether the server runs Model Runner V1.\n- Check whether `thinking_token_budget` is accepted by the server's completion route.","fix":"- `vllm` `0.28.0` (patched version per the advisory; fixed in pull request 49613)","status":"open","published_at":"2026-11-09T17:30:49+00:00","first_seen_at":"2026-11-09T22:53:22+00:00","triaged_at":"2026-11-09T22:56:25+00:00","updated_at":"2026-11-09T22:56:25+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:56:25Z","model":"claude-haiku-5-5","output":{"fix":"- `vllm` `0.28.0` (patched version per the advisory; fixed in pull request 49613)","reach":"internet","title":"vLLM: sparse state aliasing forces reasoning-end token into another request's output","impact":"low","summary":"When vLLM's thinking budget is reached, a row-move bug in the V1 sampler can copy one request's budget state onto a concurrent request in the same batch. The other request then has the configured reasoning-end token (such as </think>) forced into its output, a cross-request integrity break with no code execution shown.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["vllm","python","llm-serving","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"another user's output gets the reasoning-end token forced in","analyst_note":"","how_to_check":"- Run `pip show vllm` and check whether the version is at least `0.21.0` and below `0.28.0`.\n- Check whether reasoning support is enabled with `reasoning_end_str` configured, and whether the server runs Model Runner V1.\n- Check whether `thinking_token_budget` is accepted by the server's completion route.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["non-reasoning-models","model-runner-v2","default-config"],"who_is_affected":"Teams that serve models with vLLM's OpenAI-compatible completion route and have reasoning support enabled with a reasoning end string configured, on the legacy Model Runner V1. Exposure needs concurrent requests sharing a batch and a mixed reorder in the attention backend, so single-tenant or non-reasoning deployments can skip it. Versions 0.21.0 through 0.27.1 are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001055,"input_tokens":7322,"output_tokens":646,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111':400C '-488':43B,113C '-519':530C '-585':559C '/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l101-l107)):':395C '/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l515-l556),':509C '/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l585));':515C '/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l82-l115).':376C '/vllm-project/vllm/tree/752a3a504485790a2e8491cacbb35c137339ad34)':366C '100':399C '1e9':571C '3xrf':31A,36A '515':529C '583':558C '752a3a504485':363C '7q96':32A,37A 'activ':568C,574C 'affect':121C,126C,355C 'ai':40B 'ai-tool':39B 'alias':6A,269C,473C,516C 'anoth':24A,316C 'appli':498C 'attent':227C 'avoid':560C 'backend':228C 'batch':11A,82B,196C,200C,232C,272C,326C,370C 'batch-row':195C 'batch_update.moved':406C 'branch':210C,380C,447C 'break':105B,339C 'budget':3A,56B,73B,144C,159C,243C,285C 'bug':63B 'buggi':378C 'co':10A 'co-batch':9A 'code':108B,347C,356C 'commit':362C 'compat':154C 'complet':155C 'concurr':77B,317C 'confidenti':351C 'configur':89B,165C,309C 'confirm':361C 'continu':545C 'copi':69B,248C 'cpu':561C,570C 'cross':102B,336C 'cross-request':101B,335C 'cwe':42B,112C 'data':116C 'demonstr':354C 'destin':251C 'dictionari':191C 'direct':404C,408C 'drive':293C 'e.g':171C 'ecosystem':122C 'element':117C 'els':432C 'end':21A,92B,168C,297C,312C,471C,495C,524C,553C 'endpoint':213C,383C,450C,464C 'entri':224C,257C 'everi':485C 'execut':109B,348C 'exposur':114C 'fals':554C 'fill':564C 'forc':17A,96B,163C,290C,307C,481C,499C,502C,523C,576C 'forced-token':289C,480C 'fpch':30A,35A 'full':566C 'get':215C,385C,452C 'ghsa':29A,34A 'ghsa-fpch-3xrf-7q96':28A,33A 'github.com':365C,375C,394C,508C,514C 'github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l101-l107)):':393C 'github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l515-l556),':507C 'github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l585));':513C 'github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l82-l115).':374C 'github.com/vllm-project/vllm/tree/752a3a504485790a2e8491cacbb35c137339ad34)':364C 'gpu':562C 'host':50B 'i1':402C,412C,430C,435C,476C 'i2':403C,415C,422C,443C,478C 'idx':533C,539C,549C 'impact':352C 'implement':201C 'index':198C 'indic':569C,575C 'instead':386C 'intact':260C 'integr':104B,338C 'iter':484C 'key':192C,460C 'l101':391C 'l101-l107':390C 'l107':392C 'l115':373C 'l515':505C 'l515-l556':504C 'l556':506C 'l585':512C 'l82':372C 'l82-l115':371C 'left':259C 'legaci':179C 'len':567C 'line':398C,528C,557C 'link':357C 'llm':45B 'llm-serv':44B 'logic':207C 'logit':501C 'logits.index':572C 'logits.new':565C 'loop':503C 'make':518C 'mix':15A,231C,329C 'model':136C,181C 'move':62B,206C 'movedirectionality.swap':409C 'mutabl':194C,264C,469C 'never':220C,456C 'next':275C 'none':420C,428C,436C,441C 'num':543C 'object':266C,470C 'occur':331C 'one':70B,235C,303C,463C 'onto':7A,75B 'openai':153C 'openai-compat':152C 'ordinari':304C 'origin':255C 'output':27A,99B,176C,320C 'own':240C,282C,465C 'packag':123C 'paramet':149C 'patch':138C 'phase':496C 'pin':358C 'pip':124C 'pop':388C 'practic':302C 'public':147C 'put':573C 'python':47B,396C,526C,555C 'reach':58B,161C 'read':211C,381C,448C 'reason':20A,91B,167C,296C,311C,494C 'reasoning-end':19A,90B,166C,295C,310C,493C 'reassign':217C,454C 'receiv':521C 'remov':221C,457C 'reorder':229C,330C 'request':12A,25A,71B,78B,85B,103B,174C,286C,305C,318C,337C 'rout':156C 'row':61B,197C,205C,252C,256C,273C,280C,487C,520C 'row-mov':60B,204C 'runner':137C,182C 'sampl':148C,276C 'sampler':67B 'self':49B 'self-host':48B 'self._state':421C,429C,442C,547C 'self._state.get':411C,414C 'self._state.keys':536C 'self._state.pop':434C 'self.cu':542C 'seq':532C,538C,548C 'sequenc':170C,314C 'serv':46B 'session':120C 'share':324C 'shown':110B 'side':236C 'singl':263C,468C 'sink':292C,483C 'sort':535C 'sourc':223C,459C 'spars':4A,190C,486C 'state':5A,74B,184C,244C,246C,265C,433C,438C,444C,466C,489C,517C,546C 'state.get':551C 'state1':410C,417C,423C 'state2':413C,425C,431C 'step':277C 'summari':141C 'swap':16A,209C,239C,379C,446C 'sync':563C 'think':2A,55B,142C,242C 'thinking-budget':1A,241C 'thinking_budget_state.py':497C 'thinkingbudgetstatehold':188C 'thinkingbudgetstateholder.sync':199C,369C 'token':22A,93B,143C,169C,291C,298C,313C,482C,525C,544C,577C 'tool':41B 'track':186C 'treat':278C 'two':271C,323C 'use':133C 'v0.21.0':129C 'v0.25.1':367C 'v0.27.1':131C 'v0.28.0':140C 'v1':66B,135C,180C 'version':127C,139C 'victim':343C 'visibl':340C 'vllm':38A,51B,53B,125C,128C,162C 'vllm/v1/sample/thinking_budget_state.py':368C,397C,527C,556C 'weak':111C 'whose':488C 'write':510C 'wrong':119C","nicknames":[],"mitigations":[],"who_affected":"Teams that serve models with vLLM's OpenAI-compatible completion route and have reasoning support enabled with a reasoning end string configured, on the legacy Model Runner V1. Exposure needs concurrent requests sharing a batch and a mixed reorder in the attention backend, so single-tenant or non-reasoning deployments can skip it. Versions 0.21.0 through 0.27.1 are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["vllm"],"ptokens":["vllm"],"labels":["aitooling","cwe488","llmserving","medium","pypi","python","selfhosted","vllm"],"campaign_type":null,"search_a":"'3xrf':31A,36A '7q96':32A,37A 'alias':6A 'anoth':24A 'batch':11A 'budget':3A 'co':10A 'co-batch':9A 'end':21A 'forc':17A 'fpch':30A,35A 'ghsa':29A,34A 'ghsa-fpch-3xrf-7q96':28A,33A 'mix':15A 'onto':7A 'output':27A 'reason':20A 'reasoning-end':19A 'request':12A,25A 'spars':4A 'state':5A 'swap':16A 'think':2A 'thinking-budget':1A 'token':22A 'vllm':38A","search_b":"'-488':43B 'ai':40B 'ai-tool':39B 'batch':82B 'break':105B 'budget':56B,73B 'bug':63B 'code':108B 'concurr':77B 'configur':89B 'copi':69B 'cross':102B 'cross-request':101B 'cwe':42B 'end':92B 'execut':109B 'forc':96B 'host':50B 'integr':104B 'llm':45B 'llm-serv':44B 'move':62B 'one':70B 'onto':75B 'output':99B 'python':47B 'reach':58B 'reason':91B 'reasoning-end':90B 'request':71B,78B,85B,103B 'row':61B 'row-mov':60B 'sampler':67B 'self':49B 'self-host':48B 'serv':46B 'shown':110B 'state':74B 'think':55B 'token':93B 'tool':41B 'v1':66B 'vllm':51B,53B","search_c":"'-111':400C '-488':113C '-519':530C '-585':559C '/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l101-l107)):':395C '/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l515-l556),':509C '/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l585));':515C '/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l82-l115).':376C '/vllm-project/vllm/tree/752a3a504485790a2e8491cacbb35c137339ad34)':366C '100':399C '1e9':571C '515':529C '583':558C '752a3a504485':363C 'activ':568C,574C 'affect':121C,126C,355C 'alias':269C,473C,516C 'anoth':316C 'appli':498C 'attent':227C 'avoid':560C 'backend':228C 'batch':196C,200C,232C,272C,326C,370C 'batch-row':195C 'batch_update.moved':406C 'branch':210C,380C,447C 'break':339C 'budget':144C,159C,243C,285C 'buggi':378C 'code':347C,356C 'commit':362C 'compat':154C 'complet':155C 'concurr':317C 'confidenti':351C 'configur':165C,309C 'confirm':361C 'continu':545C 'copi':248C 'cpu':561C,570C 'cross':336C 'cross-request':335C 'cwe':112C 'data':116C 'demonstr':354C 'destin':251C 'dictionari':191C 'direct':404C,408C 'drive':293C 'e.g':171C 'ecosystem':122C 'element':117C 'els':432C 'end':168C,297C,312C,471C,495C,524C,553C 'endpoint':213C,383C,450C,464C 'entri':224C,257C 'everi':485C 'execut':348C 'exposur':114C 'fals':554C 'fill':564C 'forc':163C,290C,307C,481C,499C,502C,523C,576C 'forced-token':289C,480C 'full':566C 'get':215C,385C,452C 'github.com':365C,375C,394C,508C,514C 'github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l101-l107)):':393C 'github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l515-l556),':507C 'github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l585));':513C 'github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/v1/sample/thinking_budget_state.py#l82-l115).':374C 'github.com/vllm-project/vllm/tree/752a3a504485790a2e8491cacbb35c137339ad34)':364C 'gpu':562C 'i1':402C,412C,430C,435C,476C 'i2':403C,415C,422C,443C,478C 'idx':533C,539C,549C 'impact':352C 'implement':201C 'index':198C 'indic':569C,575C 'instead':386C 'intact':260C 'integr':338C 'iter':484C 'key':192C,460C 'l101':391C 'l101-l107':390C 'l107':392C 'l115':373C 'l515':505C 'l515-l556':504C 'l556':506C 'l585':512C 'l82':372C 'l82-l115':371C 'left':259C 'legaci':179C 'len':567C 'line':398C,528C,557C 'link':357C 'logic':207C 'logit':501C 'logits.index':572C 'logits.new':565C 'loop':503C 'make':518C 'mix':231C,329C 'model':136C,181C 'move':206C 'movedirectionality.swap':409C 'mutabl':194C,264C,469C 'never':220C,456C 'next':275C 'none':420C,428C,436C,441C 'num':543C 'object':266C,470C 'occur':331C 'one':235C,303C,463C 'openai':153C 'openai-compat':152C 'ordinari':304C 'origin':255C 'output':176C,320C 'own':240C,282C,465C 'packag':123C 'paramet':149C 'patch':138C 'phase':496C 'pin':358C 'pip':124C 'pop':388C 'practic':302C 'public':147C 'put':573C 'python':396C,526C,555C 'reach':161C 'read':211C,381C,448C 'reason':167C,296C,311C,494C 'reasoning-end':166C,295C,310C,493C 'reassign':217C,454C 'receiv':521C 'remov':221C,457C 'reorder':229C,330C 'request':174C,286C,305C,318C,337C 'rout':156C 'row':197C,205C,252C,256C,273C,280C,487C,520C 'row-mov':204C 'runner':137C,182C 'sampl':148C,276C 'self._state':421C,429C,442C,547C 'self._state.get':411C,414C 'self._state.keys':536C 'self._state.pop':434C 'self.cu':542C 'seq':532C,538C,548C 'sequenc':170C,314C 'session':120C 'share':324C 'side':236C 'singl':263C,468C 'sink':292C,483C 'sort':535C 'sourc':223C,459C 'spars':190C,486C 'state':184C,244C,246C,265C,433C,438C,444C,466C,489C,517C,546C 'state.get':551C 'state1':410C,417C,423C 'state2':413C,425C,431C 'step':277C 'summari':141C 'swap':209C,239C,379C,446C 'sync':563C 'think':142C,242C 'thinking-budget':241C 'thinking_budget_state.py':497C 'thinkingbudgetstatehold':188C 'thinkingbudgetstateholder.sync':199C,369C 'token':143C,169C,291C,298C,313C,482C,525C,544C,577C 'track':186C 'treat':278C 'two':271C,323C 'use':133C 'v0.21.0':129C 'v0.25.1':367C 'v0.27.1':131C 'v0.28.0':140C 'v1':135C,180C 'version':127C,139C 'victim':343C 'visibl':340C 'vllm':125C,128C,162C 'vllm/v1/sample/thinking_budget_state.py':368C,397C,527C,556C 'weak':111C 'whose':488C 'write':510C 'wrong':119C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:30:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-fpch-3xrf-7q96","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-fpch-3xrf-7q96","severity":"medium","published_at":"2026-11-09T17:30:49+00:00","modified_at":"2026-11-09T17:30:49+00:00","first_seen_at":"2026-11-09T22:53:22+00:00","fetched_at":"2026-11-09T22:53:22+00:00","note":null}],"documents":[{"id":110576,"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-fpch-3xrf-7q96","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}