CVE-2026-116174: vLLM improper input validation in Rust gRPC Generate

CVE-2026-116174 · Severity: medium · CVSS 5.9 · Published 2026-10-25

vLLM is an open-source language model serving engine that handles AI inference requests. The Rust gRPC interface fails to validate token IDs in prompts, allowing attackers to send malformed requests that crash the server's embedding engine and cause service outages. An attacker with network access to the gRPC endpoint can trigger this denial of service with a single crafted request.

Technologies: vLLM Project vllm. Vendors: vLLM Project.

Quick answers

Is CVE-2026-116174 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-116174 being exploited in the wild.
How severe is CVE-2026-116174?
Medium severity, with a CVSS score of 5.9, published 25 October 2026.
Which products and versions are affected?
vLLM Project vllm 0.22.0 to before 0.24.0.
Is there a fix for CVE-2026-116174?
Yes: fixed in 0.24.0. Until then: Restrict network access to the Rust gRPC endpoint to trusted clients only, or disable the gRPC service if it is not required for your deployment. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116174 attacked?
It is attacked over the network.
Am I affected by CVE-2026-116174?
Check whether you run vLLM Project vllm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 0.24.0

Restrict network access to the Rust gRPC endpoint to trusted clients only, or disable the gRPC service if it is not required for your deployment.

Technical details

The vulnerability exists in the Rust gRPC Generate and GenerateStream handlers, which accept pre-tokenized prompt token IDs from the protobuf TokenIds field and forward them directly to EngineCore without validating them against the model's vocabulary. Out-of-vocabulary token ID values cause a fatal embedding lookup failure in the engine. The HTTP /inference/v1/generate route was previously patched with token-id range validation (PR #45441), but the gRPC sibling service lacks equivalent guards.

Affected products

  • vLLM Project vLLM 0.22.0 to before 0.24.0

Timeline

  • 2026-10-09: disclosed
  • 2026-10-25: advisory
  • 2026-10-25: patched: Fixed in version 0.24.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.