{"data":{"id":"524e185c-4ae7-4ab7-a32c-69f84cad661b","title":"CVE-2026-116174: vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and…","summary":"vLLM from 0.22.0 before 0.24.0 has an improper input validation flaw in the Rust gRPC Generate and GenerateStream service, which forwards unchecked prompt token IDs to EngineCore. An attacker can submit requests with out-of-vocabulary prompt.token_ids values, triggering a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116174","publishedAt":"2026-10-25T14:16:56.877Z","cveId":"CVE-2026-116174","cweIds":["CWE-20"],"cvssScore":"5.9","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM improper input validation in Rust gRPC Generate service","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-25T18:08:32.817Z","kevDateAdded":null,"advisoryAliases":["GHSA-6gg7-pp4x-7486"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-25T18:08:39.021Z","patchAvailable":null,"disclosureDate":"2026-10-25T14:16:56.877Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":null}}