MediumVulnerabilityLLM-specific
CVE-2026-116174: vLLM improper input validation in Rust gRPC Generate service
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-116174
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
vLLM from 0.22.0 before 0.24.0 has an improper input validation flaw in the Rust gRPC Generate and GenerateStream service, which forwards unchecked prompt token IDs to EngineCore. An attacker can submit requests with out-of-vocabulary prompt.token_ids values, triggering a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Topics
Related items
- MediumCVE-2026-116181: vLLM improper input validation of stop_token_ids crashes engineSimilar attack · NVD/CVE Database
- HighCVE-2026-116180: vLLM denial of service through prompt_logprobs on cached prefixesSimilar attack · NVD/CVE Database
- HighCVE-2026-116179: vLLM resource exhaustion through media_io_kwargs video frame-count overrideSimilar attack · NVD/CVE Database
- MediumCVE-2026-116178: vLLM denial of service via inconsistent multimodal metadataSimilar attack · NVD/CVE Database
- HighCVE-2026-116177: vLLM uncontrolled resource consumption via image decompression bombSimilar attack · NVD/CVE Database