{"id":"CVE-2026-116174","kind":"vulnerability","aliases":["CVE-2026-116174"],"related":[],"title":"vLLM: out-of-vocabulary token IDs crash the engine over gRPC","description":"vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.","summary":"vLLM's Rust gRPC Generate and GenerateStream services forward prompt token IDs to EngineCore without checking them. A request with out-of-vocabulary prompt.token_ids triggers a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","grpc","python","self-hosted","vllm"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed version with `pip show vllm` and look for a version from `0.22.0` up to, but not including, `0.24.0`.\n- Confirm whether the gRPC frontend is enabled and reachable from untrusted networks.","fix":"- Upgrade vLLM to `0.24.0` or later.\n- Until upgraded, restrict access to the gRPC port to trusted clients.","status":"open","published_at":"2026-10-25T14:16:56+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:26+00:00","updated_at":"2026-10-25T14:42:26+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T14:42:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vLLM to `0.24.0` or later.\n- Until upgraded, restrict access to the gRPC port to trusted clients.","reach":"network","title":"vLLM: out-of-vocabulary token IDs crash the engine over gRPC","impact":"medium","summary":"vLLM's Rust gRPC Generate and GenerateStream services forward prompt token IDs to EngineCore without checking them. A request with out-of-vocabulary prompt.token_ids triggers a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.","category":"ai-tooling","nicknames":[],"who_cares":["vllm","self-hosted","grpc","python"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Remote requests crash the inference engine and leave the server unhealthy","analyst_note":"Check the NVD entry and the vLLM 0.24.0 release notes or advisory to confirm the gRPC service default and whether authentication is required.","how_to_check":"- Check the installed version with `pip show vllm` and look for a version from `0.22.0` up to, but not including, `0.24.0`.\n- Confirm whether the gRPC frontend is enabled and reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Teams running vLLM 0.22.0 through 0.23.x with the Rust gRPC Generate or GenerateStream service exposed to clients. Deployments that only serve local or trusted callers over HTTP without the gRPC endpoint are less exposed; the sources do not say which configurations enable the gRPC service by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000645,"input_tokens":3366,"output_tokens":617,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116174':15A,18A '-2026':14A,17A '0.22.0':70C '0.24.0':72C 'ai':20B 'ai-tool':19B 'attack':95C 'check':43B 'contain':73C 'crash':8A 'cve':13A,16A 'embed':57B,111C 'engin':10A 'enginecor':41B,62B,94C,116C 'failur':59B,113C 'fatal':56B,110C 'forward':36B,88C 'generat':32B,83C 'generatestream':34B,85C 'grpc':12A,22B,31B,82C 'host':26B 'id':7A,39B,53B,92C,105C 'improp':75C 'input':76C 'leav':64B,118C 'lookup':58B,112C 'out-of-vocabulari':2A,48B,100C 'prompt':37B,90C 'prompt.token':52B,104C 'python':23B 'request':46B,98C 'rust':30B,81C 'self':25B 'self-host':24B 'server':66B,120C 'servic':35B,86C 'submit':97C 'termin':61B,115C 'token':6A,38B,91C 'tool':21B 'trigger':54B,108C 'uncheck':89C 'unhealthi':67B,121C 'valid':77C 'valu':106C 'vllm':1A,27B,28B,68C 'vocabulari':5A,51B,103C 'vulner':78C 'without':42B","nicknames":[],"mitigations":[],"who_affected":"Teams running vLLM 0.22.0 through 0.23.x with the Rust gRPC Generate or GenerateStream service exposed to clients. Deployments that only serve local or trusted callers over HTTP without the gRPC endpoint are less exposed; the sources do not say which configurations enable the gRPC service by default.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116174","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116174","severity":null,"published_at":"2026-10-25T14:16:56+00:00","modified_at":"2026-10-25T14:16:56+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}