VULNERABILITY INTELLIGENCE

CVE-2026-116174

CVSS score8.2 HIGH
EPSS probability0.28%
CISA KEVNot currently listed
Published2026-10-25
Last modified2026-10-29
CVSS vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Description

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references