vLLM: Denial of service via uninitialized memory in prompt logprobs
Summary
vLLM versions 0.8.5 up to, but not including, 0.31.0 can be crashed by a single crafted API request. The request uses prompt_logprobs (or echo with logprobs) against a prefix that a KV connector reports as already computed, so parts of the output buffer stay uninitialized and tokenizer decoding fails. An attacker only needs access to the same vLLM engine as other users, and the crash drops all in-flight requests of every tenant. The flaw affects availability only.
Affected
- vLLM 0.8.5 up to but not including 0.31.0
- Deployments with a KV connector (for example LMCache, NIXL, SharedStorage, P2pNccl, Offloading, MultiConnector or a custom connector)
- Red Hat AI Inference Server: listed as affected in third-party records; verify against Red Hat's advisory
- Unknown whether deployments without a KV connector are affected.
Fixed in
- vLLM 0.31.0 (per advisory; a third-party source mentions a caveat that is not described, check the advisory)
Workaround
Unknown. No workaround other than upgrading is documented. Restricting network access to vLLM reduces exposure but does not fix the flaw.
Exploitation
- Not known to be exploited; not listed in CISA KEV.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
Our recommendation
- Inventory all vLLM instances, including container images, pinned requirements and Red Hat AI Inference Server.
- Upgrade to vLLM 0.31.0 or later and verify the advisory caveat.
- Prioritise instances that use a KV connector or serve several teams or customers.
- Do not expose vLLM directly to the internet; place it behind an authenticated gateway.
- Monitor for unexpected EngineCore restarts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-rhcx-5729-88vg github.com
- VulnCheck advisory: vLLM Cross-Tenant DoS via Uninitialized LogprobsTensors www.vulncheck.com
- OpenCVE CVE-2026-116180 app.opencve.io
- VulDB CVE-2026-116180 vuldb.com
- Related upstream pull request #42245 github.com
- Security advisory summary (beri.net) www.beri.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:14.
Original description (NVD)
vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.