{"id":"CVE-2026-116172","kind":"vulnerability","aliases":["CVE-2026-116172"],"related":[],"title":"vLLM: oversized top_n in gRPC requests crashes the inference engine","description":"vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via CandidateTokens.top_n. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping top_n values to trigger torch.topk failures that terminate EngineCore.","summary":"vLLM versions 0.22.0 before 0.24.0 fail to validate the top_n field in the Rust gRPC converter, so the max_logprobs limit can be bypassed. A remote attacker sending Generate or GenerateStream requests with oversized or integer-wrapping top_n values makes torch.topk fail and terminates EngineCore, which takes the model server down.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-inference","ai-tooling","grpc","self-hosted","vllm"],"not_affected_if":["default-config","internal-network-only"],"how_to_check":"- Run `pip show vllm` and confirm whether the version is at least `0.22.0` and below `0.24.0`.\n- Check whether the gRPC server is exposed: look for the gRPC serving entrypoint and whether its port is reachable from outside the network.","fix":"- Upgrade vLLM to `0.24.0` or later.\n- Until upgraded, block external access to the gRPC port.","status":"open","published_at":"2026-10-25T14:16:56+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:26+00:00","updated_at":"2026-10-25T14:42:26+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T14:42:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vLLM to `0.24.0` or later.\n- Until upgraded, block external access to the gRPC port.","reach":"internet","title":"vLLM: oversized top_n in gRPC requests crashes the inference engine","impact":"medium","summary":"vLLM versions 0.22.0 before 0.24.0 fail to validate the top_n field in the Rust gRPC converter, so the max_logprobs limit can be bypassed. A remote attacker sending Generate or GenerateStream requests with oversized or integer-wrapping top_n values makes torch.topk fail and terminates EngineCore, which takes the model server down.","category":"ai-tooling","nicknames":[],"who_cares":["vllm","ai-inference","self-hosted","grpc"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote requests crash the inference engine, causing denial of service.","analyst_note":"Confirm from the NVD entry or the vLLM advisory whether the flaw is only in the gRPC path and whether authentication is required; the sources here do not say.","how_to_check":"- Run `pip show vllm` and confirm whether the version is at least `0.22.0` and below `0.24.0`.\n- Check whether the gRPC server is exposed: look for the gRPC serving entrypoint and whether its port is reachable from outside the network.","needs_analyst":true,"not_affected_if":["default-config","internal-network-only"],"who_is_affected":"Teams that run vLLM 0.22.0 through 0.24.0 with the Rust gRPC frontend serving Generate or GenerateStream requests. Exposure is greatest where the gRPC port is reachable from untrusted clients. Teams on earlier or later versions, or using only the HTTP API, can likely skip it, but the sources do not say which API surface is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000669,"input_tokens":3357,"output_tokens":666,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116172':14A,17A '-2026':13A,16A '0.22.0':31B,84C '0.24.0':33B,86C 'ai':19B,22B 'ai-infer':18B 'ai-tool':21B 'allow':99C 'attack':56B,101C,110C 'bypass':53B,103C 'candidatetokens.top':108C 'contain':87C 'convert':45B,97C 'crash':8A 'cve':12A,15A 'engin':11A 'enginecor':76B,132C 'fail':34B,73B 'failur':129C 'field':40B 'generat':58B,113C 'generatestream':60B,115C 'grpc':6A,24B,44B,96C 'host':27B 'improp':89C 'infer':10A,20B 'input':90C 'integ':66B,121C 'integer-wrap':65B,120C 'limit':50B,106C 'logprob':49B,105C 'make':71B 'max':48B,104C 'model':80B 'n':4A,39B,69B,109C,124C 'overs':2A,63B,118C 'remot':55B,100C 'request':7A,61B,116C 'rust':43B,95C 'self':26B 'self-host':25B 'send':57B,112C 'server':81B 'take':78B 'termin':75B,131C 'tool':23B 'top':3A,38B,68B,123C 'torch.topk':72B,128C 'trigger':127C 'valid':36B,91C 'valu':70B,125C 'version':30B 'via':107C 'vllm':1A,28B,29B,82C 'vulner':92C 'wrap':67B,122C","nicknames":[],"mitigations":[],"who_affected":"Teams that run vLLM 0.22.0 through 0.24.0 with the Rust gRPC frontend serving Generate or GenerateStream requests. Exposure is greatest where the gRPC port is reachable from untrusted clients. Teams on earlier or later versions, or using only the HTTP API, can likely skip it, but the sources do not say which API surface is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116172","severity":null,"published_at":"2026-10-25T14:16:56+00:00","modified_at":"2026-10-25T14:16:56+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}