Live › vulnerability › CVE-2026-116180
Go to dashboardA flaw in vLLM's V1 engine lets a client that shares the engine send a request with prompt_logprobs (or echo with logprobs) against a KV-connector-cached prefix. The resulting tokenizer OverflowError crashes EngineCore and drops every co-tenant request.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Deployments running vLLM 0.8.5 up to 0.31.0 that serve multiple clients from one engine and use a KV connector for prefix caching are exposed. Single-tenant setups without a KV connector, or ones where clients are fully trusted, carry much less risk.
No product ranges from the sources yet.
pip show vllm or python -c "import vllm; print(vllm.__version__)"; versions from 0.8.5 up to but not including 0.31.0 are listed as affected.0.31.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests.
This page as .md · .json · in your agent: get_signal("CVE-2026-116180")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.