← CVE Radar
CVE-2026-116174vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate
vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.
8.2 HIGHEPSS 0.27%Not in KEVNVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.2 | HIGH | 4.0VulnCheck (CNA) | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| 7.5 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 5.9 | MEDIUM | 3.1VulnCheck (CNA) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Details
- CVE ID
- CVE-2026-116174
- Status
- Analyzed
- Assigner (CNA)
- VulnCheck
- Published
- Oct 25, 2026
- Last modified
- 2026-10-29 17:18 UTC
- Weaknesses
- CWE-20 · Improper Input Validation
Affected Products
As published by the CNA in the CVE record.
vllm-projectvllm1 version range
- 0.22.0 before 0.24.0