---
id: "CVE-2026-116174"
kind: "vulnerability"
aliases: ["CVE-2026-116174"]
title: "vLLM: out-of-vocabulary token IDs crash the engine over gRPC"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "grpc", "python", "self-hosted", "vllm"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-10-25T14:16:56+00:00"
first_seen_at: "2026-10-25T14:41:23+00:00"
updated_at: "2026-10-25T14:42:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116174", "first_seen_at": "2026-10-25T14:41:23+00:00"}]
---

# vLLM: out-of-vocabulary token IDs crash the engine over gRPC

vLLM's Rust gRPC Generate and GenerateStream services forward prompt token IDs to EngineCore without checking them. A request with out-of-vocabulary prompt.token_ids triggers a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show vllm` and look for a version from `0.22.0` up to, but not including, `0.24.0`.
- Confirm whether the gRPC frontend is enabled and reachable from untrusted networks.

## Fix

- Upgrade vLLM to `0.24.0` or later.
- Until upgraded, restrict access to the gRPC port to trusted clients.

## Timeline

- 2026-10-25T14:41:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116174

## From the sources

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_