CVE-2026-116172: vLLM improper input validation in Rust gRPC converter

CVE-2026-116172 · Severity: medium · CVSS 5.9 · Published 2026-10-25

vLLM is an open-source inference engine for large language models. A vulnerability in its Rust gRPC interface allows remote attackers to send specially crafted requests that bypass safety limits on log probability output, causing the inference engine to crash and stop processing requests. An attacker can trigger a denial-of-service condition by requesting oversized or malformed token candidate data.

Technologies: vLLM Project vllm. Vendors: vLLM Project.

Quick answers

Is CVE-2026-116172 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-116172 being exploited in the wild.
How severe is CVE-2026-116172?
Medium severity, with a CVSS score of 5.9, published 25 October 2026.
Which products and versions are affected?
vLLM Project vllm 0.22.0 to 0.23.x.
Is there a fix for CVE-2026-116172?
Yes: fixed in vLLM 0.24.0. Until then: Do not expose the Rust gRPC endpoint to untrusted networks without additional authentication and access controls. Restrict access to authorized clients only until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116172 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-116172?
Check whether you run vLLM Project vllm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: vLLM 0.24.0

Do not expose the Rust gRPC endpoint to untrusted networks without additional authentication and access controls. Restrict access to authorized clients only until upgrading.

Technical details

The Rust gRPC converter fails to validate the CandidateTokens.top_n field from ResponseOptions before casting it from uint32 to i32 and passing it to the sampling engine. An attacker can send Generate or GenerateStream requests with oversized top_n values or integer-wrapping values (e.g., 2_147_483_648 casting to negative -2_147_483_648) that bypass the intended max_logprobs limit, causing torch.topk() to fail and terminate the EngineCore process. Network-reachable without authentication if deployed without additional credential requirements.

Affected products

  • vLLM Project vLLM 0.22.0 to 0.23.x

Timeline

  • 2026-10-09: disclosed
  • 2026-10-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.