# CVE-2026-116180: vLLM prompt logprobs cross-tenant denial of service

Source: https://junglewise.ai/threats/cve-2026-116180-vllm-from-0-8-5-before-0-31-0-has-a-denial-of-service-flaw  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-25  
License: CC BY 4.0 with a link back

CVE-2026-116180 · Severity: high · CVSS 7.7 · Published 2026-10-25

vLLM is a machine learning inference engine that powers language model APIs. A client sharing the same engine instance can crash the engine process by sending specially crafted requests with prompt log-probability parameters, killing all in-flight requests from all tenants sharing that engine. An attacker only needs to know that a KV cache connector is in use and send a single API request, making the attack trivial to exploit at scale.

Technologies: [vLLM Project vllm](https://junglewise.ai/threats/technologies/vllm-project-vllm). Vendors: [vLLM Project](https://junglewise.ai/threats/vendors/vllm-project).

## Quick answers

**Is CVE-2026-116180 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116180 being exploited in the wild.

**How severe is CVE-2026-116180?** High severity, with a CVSS score of 7.7, published 25 October 2026.

**Which products and versions are affected?** vLLM Project vllm 0.8.5 to 0.30.x.

**Is there a fix for CVE-2026-116180?** Yes: fixed in 0.31.0. Until then: Disable KV connectors or disable prompt_logprobs requests until upgrade to 0.31.0; restrict API access to trusted clients only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116180 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116180?** Check whether you run vLLM Project vllm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.31.0

Disable KV connectors or disable prompt_logprobs requests until upgrade to 0.31.0; restrict API access to trusted clients only.

## Technical details

LogprobsTensors.empty_cpu() allocates uninitialized int32 tensors via torch.empty(). When the V1 model runner processes a request with prompt_logprobs against a prefix cached by a KVConnectorBase_V1 subclass, positions [0 .. num_computed_tokens - 1] remain unwritten. Downstream tokenizer.decode() on garbage values raises OverflowError, crashing EngineCore and dropping all co-tenant traffic. The issue is reachable via LMCacheConnectorV1, NixlConnector, and other KV connector implementations.

## Affected products

- vLLM project vLLM 0.8.5 to 0.30.x

## Timeline

- 2026-10-09: advisory
- 2026-10-25: disclosed

## References

- [https://github.com/vllm-project/vllm/security/advisories/GHSA-rhcx-5729-88vg](https://github.com/vllm-project/vllm/security/advisories/GHSA-rhcx-5729-88vg)
- [https://www.vulncheck.com/advisories/vllm-from-0.8.5-before-0.31.0-cross-tenant-dos-via-uninitialized-logprobstensors](https://www.vulncheck.com/advisories/vllm-from-0.8.5-before-0.31.0-cross-tenant-dos-via-uninitialized-logprobstensors)

## Related threats

- [vLLM chat template resource exhaustion DoS](https://junglewise.ai/threats/cve-2026-115918-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM off-by-one error in tokenizer max_token_id validation](https://junglewise.ai/threats/cve-2026-115916-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM image format validation bypass in media processing](https://junglewise.ai/threats/cve-2026-115915-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM Phi-4 multimodal audio encoder GPU memory exhaustion](https://junglewise.ai/threats/cve-2026-115913-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM arbitrary code execution in shared-memory multimodal cache](https://junglewise.ai/threats/cve-2026-115912-vllm-is-an-inference-and-serving-engine-for-large-language)