CyberRota Analysis
AI-GeneratedAn integer overflow vulnerability in vLLM's activation_kernels.cu prior to version 0.27.0 can lead to cross-user data leakage, where one user's inference request may inadvertently receive data from another user's input within the same batch. This could compromise the confidentiality of sensitive information processed by large language models. Organizations utilizing vLLM for inference should prioritize upgrading to version 0.27.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or complete copy of another user's inference result. This issue is fixed in version 0.27.0.