CVE-2026-116174: vLLM: gRPC invalid token IDs crash EngineCore (DoS)

CVE-2026-116174 is an input validation flaw in vLLM's Rust gRPC Generate and GenerateStream service, which forwards unchecked prompt token IDs to the inference engine. A single request with out-of-vocabulary token IDs triggers a fatal embedding lookup failure that kills EngineCore and leaves the server unhealthy, so any client able to reach the gRPC port can take down inference. Severity is medium (CVSS 5.9, availability-only, no confidentiality or integrity impact), and there is no EPSS data, no KEV listing, no public exploit and no Nuclei template, so near-term mass exploitation looks unlikely. The risk is concentrated in production deployments that expose the gRPC endpoint to untrusted networks or multi-tenant users. Upgrade to vLLM 0.24.0 or later, and until then restrict the gRPC port to trusted callers or validate token IDs in a gateway in front of it.

No confirmed active exploitation of CVE-2026-116174 has been reported, but organizations should still patch proactively.

1) Upgrade vLLM to 0.24.0 or later. 2) Until patched, do not expose the gRPC port to untrusted networks; restrict it with network policies, mTLS or an authenticating API gateway. 3) Add a validating proxy that rejects prompt token IDs outside the model's vocabulary range before they reach vLLM. 4) Configure health checks and automatic restarts so an unhealthy EngineCore is detected and replaced quickly. 5) Detect by alerting on EngineCore fatal errors or embedding index errors in vLLM logs, unexpected server restarts, and gRPC requests carrying unusually large token ID values. 6) Review the GHSA-w2v2-5662-8v5q advisory for any further workarounds.

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference, gRPC inference APIs, RAG pipelines, agent frameworks.

CVE-2026-116174 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.28%.