CVE-2026-116172

Name of the Vulnerable Software and Affected Versions vLLM versions 0.22.0 through 0.23.x

Description Improper input validation in the Rust gRPC converter allows remote attackers to bypass max logprobs limits. By sending Generate or GenerateStream requests with oversized or integer-wrapping values in the CandidateTokens.top n variable, an attacker can trigger torch.topk() failures, which results in the termination of EngineCore.

Recommendations Update vLLM to version 0.24.0 or later.