vLLM: Denial of Service via Rust gRPC Generate

Summary

vLLM from 0.22.0 before 0.24.0 has an improper input validation flaw in the Rust gRPC Generate and GenerateStream services. Prompt token IDs are forwarded unchecked to the EngineCore component. A request with an out-of-vocabulary token ID causes a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy until it is restarted. No authentication is required (PR:N), so a remote attacker with network access to the gRPC endpoint can trigger the denial of service.

Affected

• vLLM 0.22.0 up to but excluding 0.24.0
• Relevant only where the Rust gRPC interface (Generate and GenerateStream) is exposed
• Unknown whether the Rust gRPC frontend is enabled by default

Fixed in

• Upgrade to vLLM 0.24.0 (vendor-recommended fix)

Workaround

Unknown.

Exploitation

• Not known to be exploited; not listed in CISA KEV
• CISA SSVC: exploitation none, automatable no, technical impact partial
• Public proof-of-concept not confirmed

Our recommendation

• Check whether vLLM 0.22.x or 0.23.x is in use and whether the Rust gRPC interface is enabled
• Upgrade to vLLM 0.24.0 as a priority, especially if the gRPC endpoint is reachable from untrusted networks
• Restrict access to the gRPC endpoint to trusted clients and networks until the upgrade is done
• Monitor the service for EngineCore failures and unhealthy server states

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-w2v2-5662-8v5q github.com
• VulnCheck advisory: vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate www.vulncheck.com
• VulDB entry 426230 vuldb.com
• OSV advisory CVE-2026-105754 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:05.