Skip to content
fr Sign in
8.2 High

CVE-2026-116174 vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and…

Description

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.

Affected products and versions

Product Affected versions Fixed in
vllm 0.24 earliest → < 0.24.0 0.24.0
vllm 0.22 0.22.0 → < 0.24.0 0.24.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of vllm

The 121 CVEs of vllm →
CVE-2026-115918 vLLM is an inference and serving engine for large language models 6.5 Medium CVE-2026-115917 vLLM is an inference and serving engine for large language models 3.4 Low CVE-2026-115916 vLLM is an inference and serving engine for large language models 6.5 Medium CVE-2026-115915 vLLM is an inference and serving engine for large language models 8.1 High
Track this CVE