CVE-2026-116173— vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids

Quick assessment

Affected

vllm-project vllm

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

vLLM 0.22.0 至 0.24.0（不含）版本存在一个拒绝服务漏洞，允许远程攻击者通过绕过 Rust gRPC 前端中的限制来终止 EngineCore。攻击者可发送启用了且包含超过 128 个的或请求，从而触发致命的采样器异常，导致引擎崩溃。

CVSS 5.9 · Medium Updated Oct 25, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids

Source: CVE Program / CVE List V5

Vulnerability Description

vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with output_logprobs enabled and more than 128 output_candidates.token_ids, triggering a fatal sampler exception that crashes the engine.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

输入验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
vllm-project	vllm	0.22.0 ~ 0.24.0	-

II. Public POCs for CVE-2026-116173

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116173

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-116173 (1)

🔗 vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116173

Same Patch Batch · vllm-project · 2026-10-25 · 10 CVEs total

CVE-2026-116176	8.2 HIGH	vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector
CVE-2026-116180	7.7 HIGH	vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors
CVE-2026-116179	7.5 HIGH	vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override
CVE-2026-116177	7.5 HIGH	vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass
CVE-2026-116175	6.5 MEDIUM	vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions
CVE-2026-116181	6.5 MEDIUM	vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids
CVE-2026-116174	5.9 MEDIUM	vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate
CVE-2026-116172	5.9 MEDIUM	vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n
CVE-2026-116178	5.9 MEDIUM	vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders

IV. Related Vulnerabilities

Same product: vllm

Same vendor: vllm-project

Same weakness: CWE-20