CVE-2026-116174 in vLLM
Summary
by MITRE • 10/25/2026
vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vLLM framework, specifically versions ranging from 0.22.0 up to but not including 0.24.0, contains a critical improper input validation vulnerability within its Rust-based gRPC implementation. This flaw resides in the Generate and GenerateStream services, which are responsible for handling inference requests. The core technical issue arises because these services fail to adequately validate or sanitize prompt token identifiers before forwarding them to the EngineCore component. Instead of ensuring that incoming token IDs correspond to valid entries in the model's vocabulary, the system accepts arbitrary integer values provided by the client and passes them directly into the embedding lookup mechanism without bounds checking or existence verification.
This lack of validation leads to a fatal error during runtime execution when the EngineCore attempts to retrieve embeddings for out-of-vocabulary tokens. Since the token ID does not exist in the predefined vocabulary matrix, the underlying Rust code triggers an unhandled panic rather than returning a graceful error response. In Rust applications utilizing gRPC servers, such panics often result in the termination of the worker thread or the entire EngineCore process to prevent undefined behavior and potential memory corruption. Consequently, this action effectively crashes the inference engine instance that was handling the request.
The operational impact of this vulnerability is severe due to its direct effect on service availability. When a malicious actor submits a crafted request containing invalid prompt token IDs, they can reliably trigger this fatal embedding lookup failure. This results in the immediate termination of EngineCore, causing the server to become unhealthy and unresponsive to subsequent legitimate requests. For production environments relying on vLLM for high-throughput inference services, this constitutes a significant denial-of-service vector that allows remote attackers to disrupt service continuity with minimal effort. The vulnerability aligns with CWE-20 Improper Input Validation as it stems from the failure to verify user-supplied data against expected constraints before processing. Furthermore, in the context of the MITRE ATT&CK framework, this behavior is consistent with techniques related to Resource Exhaustion or Service Disruption under Tactic Impact, where an attacker aims to degrade or destroy system availability through targeted exploitation rather than gaining unauthorized access to data.
To mitigate this risk, organizations running affected versions must upgrade vLLM to version 0.24.0 or later, where the input validation logic has been corrected to properly handle out-of-vocabulary tokens without causing fatal crashes. Until an upgrade is feasible, administrators should implement strict network-level controls such as rate limiting and request filtering at the load balancer or API gateway layer. These measures can help detect and block anomalous requests containing unusual token ID patterns before they reach the vulnerable gRPC services. Additionally, deploying robust monitoring solutions that alert on sudden drops in active inference sessions or unexpected process restarts of EngineCore components can aid in rapid detection and response to potential exploitation attempts.