vLLM: Denial of service via Rust gRPC CandidateTokens.top_n

Summary

vLLM versions 0.22.0 before 0.24.0 contain an improper input validation flaw in the Rust gRPC converter. A remote attacker can send a single Generate or GenerateStream request with an oversized or integer-wrapping top_n value, which bypasses the max_logprobs limit. This causes the inference engine (EngineCore) to terminate, resulting in a denial of service that requires a restart; no confidentiality or integrity impact is reported.

Affected

• vLLM from 0.22.0 before 0.24.0 (vllm-project/vllm, pip package vllm)

Fixed in

• Upgrade to vLLM 0.24.0 or later.

Workaround

• No vendor workaround known. If upgrading is delayed, restrict access to the vLLM gRPC endpoint to trusted networks only (this measure is not vendor-confirmed for this CVE).

Exploitation

• No known exploitation reported; not listed in CISA KEV.
• A public proof-of-concept is unconfirmed.

Our recommendation

• Identify all vLLM instances and check whether any run version 0.22.0 up to 0.23.x.
• Upgrade affected instances to vLLM 0.24.0 or later and verify the fix against the GHSA advisory.
• Until the upgrade, keep the gRPC endpoint off the internet and untrusted networks.
• Monitor the service for crashes or restarts of the inference engine.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-rwfw-xvg3-3937 github.com
• VulnCheck Advisory www.vulncheck.com
• VulDB 426226 vuldb.com
• OffSeq Radar CVE-2026-116172 radar.offseq.com
• OpenCVE CVE-2026-116172 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:03.