PT-2026-123022

CVE-2026-116181

Published

2026-10-25

Updated

2026-10-25

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions vLLM versions 0.20.1 through 0.28.9

Description Improper input validation allows remote attackers to crash the engine or cause a write operation outside the V2 runner's logits buffer. This occurs when out-of-vocabulary stop token ids are supplied via OpenAI chat, completion, generate, or batch requests.

Recommendations Update vLLM to version 0.29.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jperezdealgaba

Mschwarzl

Qwertyjack

Vendors

Affected products

Weakness enumeration