Is CVE-2026-116180 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116180 being exploited in the wild.

How severe is CVE-2026-116180?

High severity, with a CVSS score of 7.7, published 25 October 2026.

Which products and versions are affected?

vLLM Project vllm 0.8.5 to 0.30.x.

How is CVE-2026-116180 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116180?

Check whether you run vLLM Project vllm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116180: vLLM prompt logprobs cross-tenant denial of service

CVE-2026-116180 · Severity: high · CVSS 7.7 · Published 2026-10-25

vLLM is a machine learning inference engine that powers language model APIs. A client sharing the same engine instance can crash the engine process by sending specially crafted requests with prompt log-probability parameters, killing all in-flight requests from all tenants sharing that engine. An attacker only needs to know that a KV cache connector is in use and send a single API request, making the attack trivial to exploit at scale.

Technologies: vLLM Project vllm. Vendors: vLLM Project.

Quick answers

Is CVE-2026-116180 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116180 being exploited in the wild.
How severe is CVE-2026-116180?: High severity, with a CVSS score of 7.7, published 25 October 2026.
Which products and versions are affected?: vLLM Project vllm 0.8.5 to 0.30.x.
Is there a fix for CVE-2026-116180?: Yes: fixed in 0.31.0. Until then: Disable KV connectors or disable prompt_logprobs requests until upgrade to 0.31.0; restrict API access to trusted clients only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116180 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116180?: Check whether you run vLLM Project vllm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.31.0

Disable KV connectors or disable prompt_logprobs requests until upgrade to 0.31.0; restrict API access to trusted clients only.

Technical details

LogprobsTensors.empty_cpu() allocates uninitialized int32 tensors via torch.empty(). When the V1 model runner processes a request with prompt_logprobs against a prefix cached by a KVConnectorBase_V1 subclass, positions [0 .. num_computed_tokens - 1] remain unwritten. Downstream tokenizer.decode() on garbage values raises OverflowError, crashing EngineCore and dropping all co-tenant traffic. The issue is reachable via LMCacheConnectorV1, NixlConnector, and other KV connector implementations.

Affected products

vLLM project vLLM 0.8.5 to 0.30.x

Timeline

2026-10-09: advisory
2026-10-25: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.