CVE-2026-116172Medium· 5.9▾ SunlitA flaw was found in vLLM. Due to improper input validation in the Rust gRPC interface, a remote attacker can bypass configured limits by sending requests with excessively large or wrapped token count values. When processed, these invalid v…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
A flaw was found in vLLM. Due to improper input validation in the Rust gRPC interface, a remote attacker can bypass configured limits by sending requests with excessively large or wrapped token count values. When processed, these invalid values trigger internal sampling failures that terminate the core engine service, resulting in a Denial of Service (DoS).
vllm: vLLM: Denial of Service via improper input validation in Rust gRPC interface — rated Moderate by Red Hat. Released 2026-10-25.
Affected:
No fix planned:
Fix deferred
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116174Medium· 5.9vllm: vllm: Denial of Service via invalid prompt token IDs in gRPC service (CVE-2026-116174)
CVE-2026-116176High· 8.2vllm: vllm: Information disclosure via SSRF in X-Request-Id header (CVE-2026-116176)
CVE-2026-116177High· 7.5vllm: vllm: Denial of Service via unconstrained image decompression (CVE-2026-116177)
CVE-2026-116181Medium· 6.5vllm: vllm: Denial of Service via unvalidated stop token identifiers (CVE-2026-116181)
CVE-2026-114051High· 7.5vllm: vllm: Denial of Service via improper token parameter validation (CVE-2026-114051)
CVE-2026-114052High· 7.5vllm: vLLM: Denial of Service via unbounded processor caching in MOSS-Audio (CVE-2026-114052)