CVE-2026-116173

Name of the Vulnerable Software and Affected Versions vLLM versions 0.22.0 through 0.23.x

Description A denial of service issue exists in the Rust gRPC frontend that allows remote attackers to terminate EngineCore. By sending Generate or GenerateStream requests with output logprobs enabled and providing more than 128 output candidates.token ids, an attacker can bypass limits and trigger a fatal sampler exception, resulting in an engine crash.

Recommendations Update vLLM to version 0.24.0 or later.