PT-2026-123015

CVE-2026-116174

Published

2026-10-25

Updated

2026-10-25

Description by

CVSS 4.0

8.2

High

MetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions vLLM versions 0.22.0 through 0.23.x

Description Improper input validation in the Rust gRPC Generate and GenerateStream services allows the forwarding of unchecked prompt token IDs to EngineCore. An attacker can submit requests containing out-of-vocabulary prompt.token ids values, triggering a fatal embedding lookup failure. This failure terminates EngineCore, resulting in an unhealthy server state.

Recommendations Update vLLM to version 0.24.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jperezdealgaba

Rexpository

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation