{"id":"CVE-2026-116178","kind":"vulnerability","aliases":["CVE-2026-116178"],"related":[],"title":"vLLM: crafted multimodal requests crash the inference engine remotely","description":"vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimodal item with repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists, producing a negative text span in Qwen2.5-VL position construction that terminates the engine.","summary":"vLLM versions from 0.20.0 before 0.30.0 let a remote caller send inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. The malformed request makes the engine build a negative text span in Qwen2.5-VL position handling, which terminates the engine and denies service to everyone using it.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","inference-server","multimodal","python","self-hosted","vllm"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed version with `pip show vllm` and treat anything from `0.20.0` up to but not including `0.30.0` as exposed.\n- Check whether the server exposes the disaggregated `/inference/v1/generate` endpoint to untrusted clients.\n- Check whether the deployment serves Qwen2.5-VL or other multimodal models.","fix":"- Upgrade vLLM to `0.30.0` or later.\n- Until upgraded, block or restrict access to `/inference/v1/generate` from untrusted networks.","status":"open","published_at":"2026-10-25T14:16:57+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:23+00:00","updated_at":"2026-10-25T14:42:23+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T14:42:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vLLM to `0.30.0` or later.\n- Until upgraded, block or restrict access to `/inference/v1/generate` from untrusted networks.","reach":"internet","title":"vLLM: crafted multimodal requests crash the inference engine remotely","impact":"medium","summary":"vLLM versions from 0.20.0 before 0.30.0 let a remote caller send inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. The malformed request makes the engine build a negative text span in Qwen2.5-VL position handling, which terminates the engine and denies service to everyone using it.","category":"ai-tooling","nicknames":[],"who_cares":["vllm","self-hosted","python","multimodal","inference-server"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Remote requests crash the inference engine, halting model serving until restart","analyst_note":"Confirm from the NVD entry or the vLLM GitHub advisory whether the disaggregated endpoint is enabled by default and whether authentication is required.","how_to_check":"- Check the installed version with `pip show vllm` and treat anything from `0.20.0` up to but not including `0.30.0` as exposed.\n- Check whether the server exposes the disaggregated `/inference/v1/generate` endpoint to untrusted clients.\n- Check whether the deployment serves Qwen2.5-VL or other multimodal models.","needs_analyst":true,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Teams running vLLM in the 0.20.0 to 0.29.x range that serve multimodal models, particularly Qwen2.5-VL, and expose the disaggregated generate endpoint to clients. Deployments that stay on text-only models or keep that endpoint internal to trusted callers face much less exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":3390,"output_tokens":678,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116178':12A,15A '-2026':11A,14A '/inference/v1/generate':45B,99C '0.20.0':31B,74C '0.30.0':33B,76C 'ai':17B 'ai-tool':16B 'allow':84C 'attack':86C,101C 'build':53B 'caller':37B 'construct':131C 'contain':77C 'craft':2A 'crash':5A,88C 'cve':10A,13A 'data':118C 'deni':67B 'denial':79C 'disaggreg':44B,98C 'endpoint':46B,100C 'engin':8A,52B,65B,90C,135C 'everyon':70B 'handl':61B 'hash':121C 'host':26B 'inconsist':39B,93C 'infer':7A,20B 'inference-serv':19B 'item':107C 'kwarg':117C 'let':34B 'list':122C 'make':50B 'malform':48B 'metadata':41B,95C 'mismatch':116C 'mm':112C,120C 'multimod':3A,22B,40B,94C,106C 'negat':55B,125C 'overlap':111C 'placehold':113C 'posit':60B,130C 'produc':123C 'python':23B 'qwen2.5-vl':59B,129C 'rang':114C 'remot':9A,36B,85C 'repeat':109C 'replay':103C 'request':4A,49B 'self':25B 'self-host':24B 'send':38B,92C 'server':21B 'servic':68B,81C 'span':57B,127C 'termin':63B,133C 'text':56B,126C 'tool':18B 'use':71B 'valid':105C 'version':29B 'vllm':1A,27B,28B,72C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Teams running vLLM in the 0.20.0 to 0.29.x range that serve multimodal models, particularly Qwen2.5-VL, and expose the disaggregated generate endpoint to clients. Deployments that stay on text-only models or keep that endpoint internal to trusted callers face much less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116178","severity":null,"published_at":"2026-10-25T14:16:57+00:00","modified_at":"2026-10-25T14:16:57+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}