UpHeron
All vulnerabilities

Servers and applications

CVE-2026-116174

vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate

Severity
High 8.2
Published
25 Oct 2026
Last changed
29 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
0.24.0
Sources
NVD, CVE Program

Description

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.

Affected software

SoftwareAffected versions
vLLMServers and applications · cna:vllm-project|vllm
  • From 0.22.0 before 0.24.0
vLLMServers and applications · cpe:a:vllm:vllm
  • From 0.22.0 before 0.24.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-116174
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-116174