vLLM: Denial of service via oversized logprob token IDs in gRPC frontend
Summary
vLLM 0.22.0 before 0.24.0 has a denial of service flaw in the Rust gRPC frontend. Remote attackers can send Generate or GenerateStream requests with output logprobs enabled and more than 128 output candidate token IDs, which bypasses the Python-side limit. This triggers a fatal sampler exception that terminates the EngineCore process, so the inference service must be restarted. The impact is limited to availability; no code execution or data access is claimed. The CVSS v4.0 score is 8.2 (High), while the CNA lists CVSS v3.1 5.9 and Positive Technologies lists 7.5, so the severity depends on how reachable the gRPC endpoint is.
Affected
- vLLM from 0.22.0 before 0.24.0 (per GitHub advisory and CNA record)
- Some PyPI listings only enumerate 0.22.0, 0.22.1 and 0.23.0
- Red Hat AI Inference Server 3 (vllm-cpu package): fix deferred
- Unknown whether Gaudi plugins or container images require separate updates
Fixed in
- vLLM 0.24.0 (input validation corrected)
- Gaudi plugin v0.24.0 is based on vLLM v0.24.0
Workaround
- No vendor-documented workaround found.
- Until upgraded, restrict access to the gRPC port to trusted networks or an authenticated reverse proxy.
- Client-side validation of request parameters helps only where clients are trusted and controlled.
Exploitation
- Not known to be exploited; not listed in CISA KEV.
- CISA SSVC: exploitation none, not automatable.
- No public proof of concept found in searches; this does not prove none exists.
Our recommendation
- Inventory all vLLM instances, including Red Hat and container deployments.
- Upgrade to vLLM 0.24.0 or later; check Red Hat AI Inference Server separately because its fix is deferred.
- Verify whether the gRPC endpoint is reachable from the internet or untrusted networks and restrict it.
- Monitor for unexpected EngineCore or engine restarts.
- Check related vLLM DoS issues published the same day, such as CVE-2026-116174, together with the upgrade.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-6pgw-f3pv-4h8q github.com
- VulnCheck advisory www.vulncheck.com
- OSV PYSEC-2026-4350 osv.dev
- VulDB CVE-2026-116173 vuldb.com
- OpenCVE CVE-2026-116173 app.opencve.io
- Red Hat CVE record RH:CVE-2026-116173 vulners.com
- Positive Technologies PT-2026-132753 vulners.com
- vLLM Gaudi plugin release notes v0.24.0 docs.vllm.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:04.
Original description (NVD)
vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with output_logprobs enabled and more than 128 output_candidates.token_ids, triggering a fatal sampler exception that crashes the engine.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.