Improper Input Validation in vLLM gRPC Services by vLLM Project
CVE-2026-116174

8.2HIGH

Key Information:

Vendor

Vllm-project

Status
Vllm
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116174?

The vLLM software, specifically versions prior to 0.24.0, contains an improper input validation vulnerability within its Rust gRPC service. This flaw allows attackers to send requests with uncontrolled prompt token IDs, potentially leading to a fatal failure in the embedding lookup process. If exploited, this vulnerability can destabilize the EngineCore, resulting in significant service disruption and making the affected server unusable.

Affected Version(s)

vllm 0.22.0 < 0.24.0

vllm 0.24.0

References

https://github.com/vllm-project/vllm/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/vllm-0.22.0-before-0...
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

rexpository
jperezdealgaba
.