CVE-2026-116174: vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate

Q: Which deployments are exposed to this issue?

vLLM versions from 0.22.0 up to, but not including, 0.24.0 are affected when the Rust gRPC Generate or GenerateStream service is reachable by an attacker.

Q: Does exploitation require authentication or user interaction?

No. The supplied vector indicates network access with no privileges and no user interaction, although exploitation has high attack complexity.

Q: What input triggers the denial of service?

An attacker submits a Generate or GenerateStream request containing prompt.token_ids values outside the model vocabulary. These unchecked token IDs reach EngineCore and can cause a fatal embedding lookup failure.

Q: What is the operational impact if exploitation succeeds?

EngineCore terminates and the vLLM server is left unhealthy, causing an availability impact. The provided information indicates no confidentiality or integrity impact.

Q: What can be done before upgrading?

Restrict access to the Rust gRPC Generate and GenerateStream endpoints to trusted clients, and validate or reject prompt.token_ids that are outside the applicable model vocabulary before forwarding requests to vLLM.

Published Oct 25, 2026

Updated

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.tokenids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.

Affected Software

1 affected component

vllm vllm>=0.22.0<0.24.0

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

vLLM versions from 0.22.0 up to, but not including, 0.24.0 are affected when the Rust gRPC Generate or GenerateStream service is reachable by an attacker.

Does exploitation require authentication or user interaction?

No. The supplied vector indicates network access with no privileges and no user interaction, although exploitation has high attack complexity.

What input triggers the denial of service?

An attacker submits a Generate or GenerateStream request containing prompt.token_ids values outside the model vocabulary. These unchecked token IDs reach EngineCore and can cause a fatal embedding lookup failure.

What is the operational impact if exploitation succeeds?

EngineCore terminates and the vLLM server is left unhealthy, causing an availability impact. The provided information indicates no confidentiality or integrity impact.

What can be done before upgrading?

Restrict access to the Rust gRPC Generate and GenerateStream endpoints to trusted clients, and validate or reject prompt.token_ids that are outside the applicable model vocabulary before forwarding requests to vLLM.

CVE-2026-116174: vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What input triggers the denial of service?

What is the operational impact if exploitation succeeds?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What input triggers the denial of service?

What is the operational impact if exploitation succeeds?

What can be done before upgrading?