AI Threat AlertCVE-2026-116178: vLLM: multimodal metadata DoS crashes inference engine
HIGHCVE-2026-116178 is a denial-of-service flaw in vLLM 0.20.0 through versions before 0.30.0. A remote attacker can crash the whole inference engine by sending inconsistent multimodal metadata (overlapping or repeated mm_placeholders ranges, or mismatched kwargs_data and mm_hashes lists) to the disaggregated /inference/v1/generate endpoint, which triggers a negative text span in Qwen2.5-VL position construction. Exploitation requires no authentication or user interaction, but CVSS 5.9 reflects high attack complexity, and the issue is not in CISA KEV, has no public exploit, no Nuclei template and no EPSS score yet. The real risk is availability: a single malformed request can take down a shared model-serving tier, so exposure matters more than the medium score suggests. Upgrade to vLLM 0.30.0 or later, and make sure the disaggregated generate endpoint is reachable only from trusted internal components.
What is the risk?
Medium overall (CVSS 5.9). Network-reachable and unauthenticated, with no user interaction needed, but high attack complexity because the attacker must craft inconsistent multimodal metadata and the deployment must expose the disaggregated endpoint with a vision-language model such as Qwen2.5-VL. Impact is limited to availability (A:H); there is no confidentiality or integrity impact. No known exploitation, no public PoC, no KEV listing, and EPSS is unavailable. Risk rises sharply for internet-exposed or multi-tenant inference clusters, where an engine crash affects every tenant and any in-flight request.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| vLLM | pip | — | No patch |
Do you use vLLM? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade vLLM to 0.30.0 or later. 2) Until patched, restrict /inference/v1/generate to trusted internal services using network policy, a service mesh or an API gateway; do not expose it directly to the internet. 3) Add gateway-side validation that rejects requests where mm_placeholders ranges overlap or repeat, or where kwargs_data and mm_hashes lengths differ. 4) Require authentication and rate limiting in front of vLLM. 5) Configure supervised restarts with backoff and alerting on repeated engine crashes. 6) Detect by monitoring for engine process exits, tracebacks around multimodal position construction, and bursts of malformed multimodal requests to the generate endpoint. Review the GHSA-34qw-q2h2-jp3m advisory for any additional guidance.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-116178?
CVE-2026-116178 is a denial-of-service flaw in vLLM 0.20.0 through versions before 0.30.0. A remote attacker can crash the whole inference engine by sending inconsistent multimodal metadata (overlapping or repeated mm_placeholders ranges, or mismatched kwargs_data and mm_hashes lists) to the disaggregated /inference/v1/generate endpoint, which triggers a negative text span in Qwen2.5-VL position construction. Exploitation requires no authentication or user interaction, but CVSS 5.9 reflects high attack complexity, and the issue is not in CISA KEV, has no public exploit, no Nuclei template and no EPSS score yet. The real risk is availability: a single malformed request can take down a shared model-serving tier, so exposure matters more than the medium score suggests. Upgrade to vLLM 0.30.0 or later, and make sure the disaggregated generate endpoint is reachable only from trusted internal components.
Is CVE-2026-116178 actively exploited?
No confirmed active exploitation of CVE-2026-116178 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-116178?
1) Upgrade vLLM to 0.30.0 or later. 2) Until patched, restrict /inference/v1/generate to trusted internal services using network policy, a service mesh or an API gateway; do not expose it directly to the internet. 3) Add gateway-side validation that rejects requests where mm_placeholders ranges overlap or repeat, or where kwargs_data and mm_hashes lengths differ. 4) Require authentication and rate limiting in front of vLLM. 5) Configure supervised restarts with backoff and alerting on repeated engine crashes. 6) Detect by monitoring for engine process exits, tracebacks around multimodal position construction, and bursts of malformed multimodal requests to the generate endpoint. Review the GHSA-34qw-q2h2-jp3m advisory for any additional guidance.
What systems are affected by CVE-2026-116178?
This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference servers, multimodal / vision-language pipelines, disaggregated inference deployments.
What is the CVSS score for CVE-2026-116178?
CVE-2026-116178 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.33%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0029Denial of AI ServiceAML.T0040AI Model Inference API AccessAML.T0049Exploit Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimodal item with repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists, producing a negative text span in Qwen2.5-VL position construction that terminates the engine.
Exploitation Scenario
An attacker finds an exposed vLLM disaggregated generation endpoint serving Qwen2.5-VL. They capture or craft one valid multimodal request, then replay it with repeated or overlapping mm_placeholders ranges or with kwargs_data and mm_hashes lists of different lengths. The server computes a negative text span during position construction and the engine terminates. The attacker resends the request each time the service restarts, keeping the multimodal inference tier offline and degrading every downstream application that relies on it.
Weaknesses (CWE)
CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- [Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
- [Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-6173210.0Decepticon: ChatML token injection yields sandbox RCE
Same package: vllmCVE-2024-110419.8vllm: RCE via unsafe pickle deserialization in MessageQueue
Same package: vllmCVE-2025-472779.8vLLM: RCE via exposed TCPStore in distributed inference
Same package: vllmCVE-2026-259609.8vllm: SSRF allows internal network access
Same package: vllmCVE-2024-90539.8vllm: RCE via unsafe pickle deserialization in RPC server
Same package: vllm