Improper Input Validation Vulnerability in vLLM from the vLLM Project
CVE-2026-116181

7.1HIGH

Key Information:

Vendor

Vllm-project

Status
Vllm
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116181?

The vLLM product versions from 0.20.1 to 0.29.0 possess an improper input validation vulnerability that poses a risk of remote denial-of-service attacks. Attackers can exploit this vulnerability by sending requests containing invalid out-of-vocabulary stop_token_ids, which can lead to crashing the engine or writing outside the V2 runner's logits buffer. This issue may allow unauthorized users to disrupt services and impact the performance of the vLLM application.

Affected Version(s)

vllm 0.20.1 < 0.29.0

vllm 0.29.0

References

https://github.com/vllm-project/vllm/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/vllm-0.20.1-before-0...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mschwarzl
jperezdealgaba
QwertyJack
.