CVE-2026-90713: vllm-project vLLM tiktoken vocab File mod.rs new denial of service

Vulnerability summary

CVE-2026-90713 is a medium (CVSS 4.8) Improper Resource Shutdown or Release vulnerability in vllm-project vllm. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 14-09-2026
   PublishedVulnerability first disclosed.
2. 15-09-2026
   Last modifiedVulnerability information updated.

Description

A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/src/backend/hf/mod.rs of the component tiktoken vocab File Handler. The manipulation results in denial of service. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

• CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.