Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116180— vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors

Quick assessment

Affected
vllm-project vllm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

vLLM 0.8.5 至 0.31.0（不含）版本存在拒绝服务漏洞。在 文件中， 函数会分配一个未初始化的 int32 张量，而 V1 模型运行器（model runner）未对由 KV 连接器（KV connector）报告为已计算的提示词位置（prompt positions）进行写入。若共享引擎的客户端针对连接器缓存的前缀发送 （或携带 的 请求），将导致分词器（tokenizer）在解码时抛出 ，进而引发 崩溃，并丢弃所有共租户的请求。

CVSS 7.7 · High

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 2

VendorProduct Version RangeStatus
vllm-project vllm 0.8.5< 0.31.0 affected
0.31.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116180

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors
Source: CVE Program / CVE List V5
Vulnerability Description
vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对未经初始化资源的使用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
vllm-project vllm 0.8.5 ~ 0.31.0 -

II. Public POCs for CVE-2026-116180

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116180

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-116180 (1)

Vendor Pages for CVE-2026-116180 (1)

Same Patch Batch · vllm-project · 2026-10-25 · 10 CVEs total

CVE-2026-116176 8.2 HIGH vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector
CVE-2026-116179 7.5 HIGH vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override
CVE-2026-116177 7.5 HIGH vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass
CVE-2026-116175 6.5 MEDIUM vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions
CVE-2026-116181 6.5 MEDIUM vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids
CVE-2026-116174 5.9 MEDIUM vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate
CVE-2026-116172 5.9 MEDIUM vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n
CVE-2026-116173 5.9 MEDIUM vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids
CVE-2026-116178 5.9 MEDIUM vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders

IV. Related Vulnerabilities

Same product: vllm
Same vendor: vllm-project
Same weakness: CWE-908