CVE-2026-116180: vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors

Q: Which deployments are realistically exposed to cross-tenant impact?

Deployments where multiple clients share the same vLLM engine are exposed, because crashing EngineCore drops requests from all co-tenants. The triggering request must use a prefix reported as already computed by a KV connector.

Q: What does an attacker need to send to trigger the crash?

The attacker needs client access sufficient to submit a request to the shared engine. They can request prompt_logprobs, or use echo with logprobs, against a connector-cached prefix; no user interaction is required.

Q: Are configurations without KV connector-cached prefixes affected by the described trigger?

The described trigger depends on prompt positions being reported as computed by a KV connector and left unwritten by the V1 model runner. The provided information does not describe an exploit path without a connector-cached prefix.

Published Oct 25, 2026

Updated

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.emptycpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send promptlogprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests.

Affected Software

1 affected component

vllm vllm>=0.8.5<0.31.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade vLLM to a version that resolves this vulnerability.
Fixed in 0.31.0

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are realistically exposed to cross-tenant impact?

Deployments where multiple clients share the same vLLM engine are exposed, because crashing EngineCore drops requests from all co-tenants. The triggering request must use a prefix reported as already computed by a KV connector.

What does an attacker need to send to trigger the crash?

The attacker needs client access sufficient to submit a request to the shared engine. They can request prompt_logprobs, or use echo with logprobs, against a connector-cached prefix; no user interaction is required.

Are configurations without KV connector-cached prefixes affected by the described trigger?

The described trigger depends on prompt positions being reported as computed by a KV connector and left unwritten by the V1 model runner. The provided information does not describe an exploit path without a connector-cached prefix.

CVE-2026-116180: vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed to cross-tenant impact?

What does an attacker need to send to trigger the crash?

Are configurations without KV connector-cached prefixes affected by the described trigger?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed to cross-tenant impact?

What does an attacker need to send to trigger the crash?

Are configurations without KV connector-cached prefixes affected by the described trigger?