Live › vulnerability › CVE-2026-116178
Go to dashboardvLLM versions from 0.20.0 before 0.30.0 let a remote caller send inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. The malformed request makes the engine build a negative text span in Qwen2.5-VL position handling, which terminates the engine and denies service to everyone using it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams running vLLM in the 0.20.0 to 0.29.x range that serve multimodal models, particularly Qwen2.5-VL, and expose the disaggregated generate endpoint to clients. Deployments that stay on text-only models or keep that endpoint internal to trusted callers face much less exposure.
No product ranges from the sources yet.
pip show vllm and treat anything from 0.20.0 up to but not including 0.30.0 as exposed./inference/v1/generate endpoint to untrusted clients.0.30.0 or later./inference/v1/generate from untrusted networks.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimodal item with repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists, producing a negative text span in Qwen2.5-VL position construction that terminates the engine.
This page as .md · .json · in your agent: get_signal("CVE-2026-116178")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.