UpHeron
All vulnerabilities

Servers and applications

CVE-2026-116172

vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n

Severity
High 8.2
Published
25 Oct 2026
Last changed
28 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
0.24.0
Sources
NVD, CVE Program

Description

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via CandidateTokens.top_n. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping top_n values to trigger torch.topk failures that terminate EngineCore.

Affected software

SoftwareAffected versions
vLLMServers and applications · cna:vllm-project|vllm
  • From 0.22.0 before 0.24.0
vLLMServers and applications · cpe:a:vllm:vllm
  • From 0.22.0 before 0.24.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-116172
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-116172