{"data":{"id":"639fa752-763b-4fb4-988a-a1f5e30b77cc","title":"CVE-2026-116181: vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to…","summary":"vLLM from 0.20.1 before 0.29.0 contains an improper input validation flaw, tracked as CVE-2026-116181. Remote attackers can supply out-of-vocabulary stop_token_ids in OpenAI chat, completion, generate, or batch requests to crash the engine or write outside the V2 runner's logits buffer.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116181","publishedAt":"2026-10-25T14:16:57.907Z","cveId":"CVE-2026-116181","cweIds":["CWE-129"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM improper input validation of stop_token_ids crashes engine","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-25T18:08:33.119Z","kevDateAdded":null,"advisoryAliases":["GHSA-f2x4-7hx3-gxfp"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-25T18:08:36.232Z","patchAvailable":null,"disclosureDate":"2026-10-25T14:16:57.907Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability","integrity"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}