AI Threat AlertCVE-2026-116173: vLLM: gRPC logprob limit bypass crashes EngineCore
HIGHCVE-2026-116173 is a denial-of-service flaw in vLLM 0.22.0 through 0.23.x where the Rust gRPC frontend fails to enforce the logprob_token_ids limit, so a single crafted Generate or GenerateStream request with more than 128 output_candidates.token_ids and output_logprobs enabled triggers a fatal sampler exception that terminates EngineCore. It is rated medium (CVSS 5.9, high attack complexity, no privileges or user interaction needed), and no EPSS score, public exploit, Nuclei template, or CISA KEV listing exists at this time, so near-term mass exploitation looks unlikely. The practical risk is availability: one crashed engine takes down the whole inference service for every tenant or application that depends on it, which matters for production LLM endpoints that expose the gRPC interface to untrusted or semi-trusted networks. Upgrade to vLLM 0.24.0 or later, and until then restrict gRPC frontend access to trusted clients, enforce request validation at a gateway, and ensure automatic engine restarts with alerting on EngineCore crashes.
What is the risk?
Low-to-medium overall. Exploitation is remote and unauthenticated, but the CVSS vector marks attack complexity as high, and impact is limited to availability (A:H, no confidentiality or integrity impact). No KEV listing, public exploit, or scanner template is known, and EPSS is unavailable. Exposure is concentrated in deployments that run the newer Rust gRPC frontend (introduced in the 0.22.x line) and make it reachable by untrusted clients. For those deployments, a single request can cause a full engine outage, so business risk rises with service criticality and the absence of automatic recovery.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| vLLM | pip | — | No patch |
Do you use vLLM? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade vLLM to 0.24.0 or later. 2) If patching is delayed, disable the Rust gRPC frontend or restrict it with network ACLs, mTLS, or a service mesh so only trusted clients can reach it. 3) Place an API gateway or proxy in front that rejects requests where output_logprobs is enabled and output_candidates.token_ids exceeds 128. 4) Run vLLM under a supervisor (Kubernetes, systemd) with automatic restart, health checks, and multi-replica redundancy. 5) Detect by alerting on EngineCore fatal sampler exceptions and unexpected process exits, and by reviewing gRPC logs for Generate/GenerateStream requests with unusually large token_ids lists. 6) Apply rate limiting and authentication on the inference endpoint.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-116173?
CVE-2026-116173 is a denial-of-service flaw in vLLM 0.22.0 through 0.23.x where the Rust gRPC frontend fails to enforce the logprob_token_ids limit, so a single crafted Generate or GenerateStream request with more than 128 output_candidates.token_ids and output_logprobs enabled triggers a fatal sampler exception that terminates EngineCore. It is rated medium (CVSS 5.9, high attack complexity, no privileges or user interaction needed), and no EPSS score, public exploit, Nuclei template, or CISA KEV listing exists at this time, so near-term mass exploitation looks unlikely. The practical risk is availability: one crashed engine takes down the whole inference service for every tenant or application that depends on it, which matters for production LLM endpoints that expose the gRPC interface to untrusted or semi-trusted networks. Upgrade to vLLM 0.24.0 or later, and until then restrict gRPC frontend access to trusted clients, enforce request validation at a gateway, and ensure automatic engine restarts with alerting on EngineCore crashes.
Is CVE-2026-116173 actively exploited?
No confirmed active exploitation of CVE-2026-116173 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-116173?
1) Upgrade vLLM to 0.24.0 or later. 2) If patching is delayed, disable the Rust gRPC frontend or restrict it with network ACLs, mTLS, or a service mesh so only trusted clients can reach it. 3) Place an API gateway or proxy in front that rejects requests where output_logprobs is enabled and output_candidates.token_ids exceeds 128. 4) Run vLLM under a supervisor (Kubernetes, systemd) with automatic restart, health checks, and multi-replica redundancy. 5) Detect by alerting on EngineCore fatal sampler exceptions and unexpected process exits, and by reviewing gRPC logs for Generate/GenerateStream requests with unusually large token_ids lists. 6) Apply rate limiting and authentication on the inference endpoint.
What systems are affected by CVE-2026-116173?
This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference endpoints, gRPC-based inference backends, RAG pipelines, agent frameworks.
What is the CVSS score for CVE-2026-116173?
CVE-2026-116173 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.34%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0029Denial of AI ServiceAML.T0040AI Model Inference API AccessAML.T0049Exploit Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with output_logprobs enabled and more than 128 output_candidates.token_ids, triggering a fatal sampler exception that crashes the engine.
Exploitation Scenario
An attacker finds a vLLM gRPC inference endpoint reachable from the internet or an internal network segment, for example one that is exposed through a misconfigured load balancer. They confirm a vulnerable version, then send a Generate or GenerateStream request with output_logprobs set and more than 128 token IDs in output_candidates. The oversized list bypasses the intended limit and reaches the sampler, which raises a fatal exception and kills EngineCore. The attacker repeats the request each time the service restarts, keeping the LLM service unavailable and disrupting dependent applications.
Weaknesses (CWE)
CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- [Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
- [Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-6173210.0Decepticon: ChatML token injection yields sandbox RCE
Same package: vllmCVE-2024-110419.8vllm: RCE via unsafe pickle deserialization in MessageQueue
Same package: vllmCVE-2025-472779.8vLLM: RCE via exposed TCPStore in distributed inference
Same package: vllmCVE-2026-259609.8vllm: SSRF allows internal network access
Same package: vllmCVE-2024-90539.8vllm: RCE via unsafe pickle deserialization in RPC server
Same package: vllm